With almost 40k subscribers on Reddit, r/ScamNumbers is one of the most useful online databases for tracking down scam phone numbers. Some use the information for awareness, while others take advantage by prank calling scammers to waste their time.
Whatever the case may be, we have a zero-tolerance policy towards personal phone numbers. We have enforced this rule severely on Reddit and will do the same here.
We also have a Matrix space!
But why is it hosted on a .zip domain? Edit: for clarification, I don’t have anything against having different instances. I’m just wary of anything using the .zip tld.
I’ve switched instances from lemmy.world to lemmy.zip as .world was very slow with updating their server
lemmy.zip is a tech oriented instance. They have !technology@lemmy.zip and !databreaches@lemmy.zip which are quite interesting
Yes, I’m trying to promote that instance a bit, the admins put a lot of work into it
Oh badd Google!
Great writeup and easy to understand. What would be a solution to this problem?
I hate that Google is exerting even more control on the internet with their TLD, but I don’t really think this attack is made all that much worse with .zip TLD. I can already bury a .com
in a long URL and end it in .zip just fine like so:
https://github.com∕foo∕bar∕baz@example.com/foo/bar/baz.zip
Or even use a subdomain to remove the @:
https://github.com∕foo∕bar∕baz.example.com/foo/bar/baz.zip
The truth is most people don’t look much at URLs outside of a domain to verify its authenticity, at which point the .zip
TLD does not do much more harm than existing domains do.
For mitigation, Firefox already doesn’t display the username portion of the URL on hover of a link and URL-encodes it if copy-pasted into the url bar. It also displays the punycode representation when hovering or navigating to the second example.
Edit: looks like lemmy now replaces 0x2215
which is a character that looks like forward slash with an actual forward slash, so my comment is a bit more confusing. For clarity, the slashes before example.com
in the above urls were 0x2215
and not “/”.
Another problem is if you’re trying to sub to a community on lemmy.zip, it can be impossible if the server hosting your instance has blocked all .zip domains through their hosts file or even their Lemmy instance. You would be able to see it, but your instance won’t.
People and admins not trusting that TLD can be just as detrimental to people interacting with legit sites on that TLD, as its potential for abuse is at making it untrustworthy to begin with
cool, subscribed.
I didn’t know there was a subreddit for this. That’s cool. Definitely subscribing.
Welcome! Consider sharing on !communityPromo@lemmy.ca
Also these are a universal links and they makes it easier for people to subscribe from other instances
- !scamnumbers@lemmy.zip (simplest, but some apps don’t support it)
- link (more complicated and requires someone to be on Lemmy when viewing the link)
Otherwise people can use something like the instance assistant browser extension
Can someone explain to me how to use this data to block calls?
I was under the impression that (at least in the US) scammers don’t reveal any real phone numbers with Caller-ID. That they just chose random numbers with your area code and similar exchange digits to try and convince you it’sa let local call (like you drs office or whatever you may be waiting on). Is that not true?