# Phishing attempts under observations? **URL:** \ **Category:** General\ **Tags:** question\ **Created:** [November 26, 2023, 12:38pm UTC](https://forum.inaturalist.org/t/phishing-attempts-under-observations/47054 "2023-11-26T12:38:59Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![ldvn](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/ldvn/32/41294_2.png) [@ldvn](https://forum.inaturalist.org/u/ldvn)\ **Post date:** [November 26, 2023, 12:38pm UTC](https://forum.inaturalist.org/t/phishing-attempts-under-observations/47054/1 "2023-11-26T12:38:59Z")
I just got a notification on an observation I reviewed 4 months ago : a suspicious account created today with zero obervation, ID, anything asked the observer to message them via an email address. “[observer] - could you please contact me? [name (most likely fake) + email]” It’s very obviously a scam to me, which I have flagged as “spam” already, but has anyone else observed similar stuff ? I couldn’t find already existing topics about this. ---
**Author:** ![insectobserver123](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/insectobserver123/32/36213_2.png) [@insectobserver123](https://forum.inaturalist.org/u/insectobserver123)\ **Post date:** [November 26, 2023, 5:46pm UTC](https://forum.inaturalist.org/t/phishing-attempts-under-observations/47054/2 "2023-11-26T17:46:56Z")
As a curator who monitors the spam log, spammers routinely post to inaturalist, probably multiple times per day, but most get flagged and are not seen by many users. This particular scam where there is no product clearly being marketed, and it is just a request to contact someone, is unusual ---
**Author:** ![DianaStuder](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/dianastuder/32/43358_2.png) [@DianaStuder](https://forum.inaturalist.org/u/DianaStuder)\ **Post date:** [November 26, 2023, 7:55pm UTC](https://forum.inaturalist.org/t/phishing-attempts-under-observations/47054/3 "2023-11-26T19:55:34Z")
Attempting to collect **active** email adresses. Then - the unwanted ads flood in. ---
**Author:** ![ItsMeLucy](https://avatars.discourse-cdn.com/v4/letter/i/49beb7/32.png) [@ItsMeLucy](https://forum.inaturalist.org/u/ItsMeLucy)\ **Post date:** [November 26, 2023, 8:27pm UTC](https://forum.inaturalist.org/t/phishing-attempts-under-observations/47054/4 "2023-11-26T20:27:13Z")
My dirty lens is coming from victim advocacy experience: It sounds like it could be a possible attempt to reestablish contact in a situation where either the Observer has blocked contact in other settings (unwanted contact) or because other social media the Observer has may be monitored by a partner (safe relationship issue). To me this feels best left to the Observer to assess. If they feel the contact is unwanted, they can contact Staff. It is very important however that the comment remain visible so the Observer can assess their own safety. (If it were an attempt to collect email addresses, a phishing attempt, I would think comments asking for emails would be flooding observations en masse.) ---
**Author:** ![jdmore](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/jdmore/32/1116_2.png) [@jdmore](https://forum.inaturalist.org/u/jdmore)\ **Post date:** [November 26, 2023, 9:49pm UTC](https://forum.inaturalist.org/t/phishing-attempts-under-observations/47054/5 "2023-11-26T21:49:41Z")
I haven’t seen that kind of comment either, but you did the right thing by flagging it. If a user gets 3 or more spam flags against them the system automatically suspends them. @ItsMeLucy makes some good points to consider. If they continue to make contact, you have the option to block their account. But if that happens I would also contact staff at [help@inaturalist.org](mailto:help@inaturalist.org). ---
**Author:** ![insectobserver123](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/insectobserver123/32/36213_2.png) [@insectobserver123](https://forum.inaturalist.org/u/insectobserver123)\ **Post date:** [November 27, 2023, 12:53am UTC](https://forum.inaturalist.org/t/phishing-attempts-under-observations/47054/6 "2023-11-27T00:53:09Z")
Or it could be malware rather than ads ---
**Author:** ![insectobserver123](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/insectobserver123/32/36213_2.png) [@insectobserver123](https://forum.inaturalist.org/u/insectobserver123)\ **Post date:** [November 27, 2023, 12:56am UTC](https://forum.inaturalist.org/t/phishing-attempts-under-observations/47054/7 "2023-11-27T00:56:58Z")
You have a point, it’s addressed to one person in the thread and there is one comment, hardly mass spam @ldvn flagged it as spam, which causes it to be invisible, in general spam or rule breaking comments are not supposed to be visible I think @tiwane should be made aware of this, so I’m tagging him in here ---
**Author:** ![ldvn](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/ldvn/32/41294_2.png) [@ldvn](https://forum.inaturalist.org/u/ldvn)\ **Post date:** [November 28, 2023, 9:33am UTC](https://forum.inaturalist.org/t/phishing-attempts-under-observations/47054/8 "2023-11-28T09:33:38Z")
@insectobserver123 Thank you for your comments on the matter, and I understand your decision regarding the flag I submitted. @ItsMeLucy I’m still leaning towards my first hypothesis but you bring up a good point, I should have left it to the judgment of the observer in the first place. I’ll keep an eye out. Thank you all for your thoughts on this ! ---
**Author:** ![insectobserver123](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/insectobserver123/32/36213_2.png) [@insectobserver123](https://forum.inaturalist.org/u/insectobserver123)\ **Post date:** [November 28, 2023, 3:32pm UTC](https://forum.inaturalist.org/t/phishing-attempts-under-observations/47054/9 "2023-11-28T15:32:23Z")
I resolved the spam flag becasue it is not clearly intended to make money, which is the only thing that is defined as spam on iNat ---
**Author:** ![whaichi](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/whaichi/32/277_2.png) [@whaichi](https://forum.inaturalist.org/u/whaichi)\ **Post date:** [November 29, 2023, 2:45am UTC](https://forum.inaturalist.org/t/phishing-attempts-under-observations/47054/10 "2023-11-29T02:45:19Z")
The spam flag on iNaturalist mentions more than just attempts to make money: > Commercial solicitation, links to nowhere, etc. ---
**Author:** ![insectobserver123](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/insectobserver123/32/36213_2.png) [@insectobserver123](https://forum.inaturalist.org/u/insectobserver123)\ **Post date:** [November 29, 2023, 11:39pm UTC](https://forum.inaturalist.org/t/phishing-attempts-under-observations/47054/11 "2023-11-29T23:39:56Z")
Where are you reading this? the curator guide links to the help page for this definition, and the help page says: > “Our definition of **spam is anything that is clearly intended to make money** , which could be links to spurious sites, or by trying to manipulate search engine indexing through lots of links to weird places.” ---
**Author:** ![whaichi](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/whaichi/32/277_2.png) [@whaichi](https://forum.inaturalist.org/u/whaichi)\ **Post date:** [November 30, 2023, 1:12am UTC](https://forum.inaturalist.org/t/phishing-attempts-under-observations/47054/12 "2023-11-30T01:12:13Z")
> [@insectobserver123](#): > > Where are you reading this? It’s what comes up under the spam flag on iNaturalist. When a user flags any comment or identification on an observation they are presented with choices on the reason for the flag. What I shared is the text that is listed for ‘spam’. ---
**Author:** ![cthawley](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.inaturalist.org/cthawley/32/1445_2.png) [@cthawley](https://forum.inaturalist.org/u/cthawley)\ **Post date:** [November 30, 2023, 1:35pm UTC](https://forum.inaturalist.org/t/phishing-attempts-under-observations/47054/13 "2023-11-30T13:35:31Z")
Agree, though I would note that “commercial solicitation” is an attempt to make money. I think “links to nowhere” generally are some type of attempt to manipulate SEO rankings or similar, which are also related to making money (though less directly). ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/inaturalist/original/2X/7/7831452cf7f0d653ff1ffd34176334b7ef1b6a17.png) [@system](https://forum.inaturalist.org/u/system)\ **Post date:** [January 29, 2024, 1:36pm UTC](https://forum.inaturalist.org/t/phishing-attempts-under-observations/47054/14 "2024-01-29T13:36:12Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.