Updates below as they become available - See Final Update: FA appears to be back, and appropriate control has been restored.
Just in case anyone hasn't seen the news floating around:
DO NOT ATTEMPT TO ACCESS FURAFFINITY AT THE MOMENT
Sometimes last night FA's domain registrar account was hijacked. Traffic is now redirected to a malicious landing page that is disguised as a legitimate storefront. And that's just at the moment. Apparently it keeps bouncing around between different landing pages.
Don't log in, don't enter credentials, don't even type in the URL. Stay far away until this mess gets sorted out, because I would wager somewhere in this mess, malware is getting doled out via drive-by. Even if the site looks "fine" for the moment, until FA staff have control of the registrar account, there is risk.
Stay safe, folks.
(Sorry to non-furry folks for clogging your feeds, but this is kinda important and CoHost is remarkably furry. The nature of the problem means that communication needs to happen outside the afflicted platform, too. I know a lot of people are still unaware of what's going on!)
UPDATE (09:00 21AUG2024): It appears that FA administration has control over the registrar account again. FA itself is intentionally down so that they can review what happened more fully before bringing it back up. While the immediate issues appears resolved, there were many knock-on issues that followed, and it's not clear the full extent of the compromise was - or might still be.
During the debacle, it looked like the attacker managed to use the hijacked registrar account to redirect incoming emails sent to FA - This likely allowed them to hijack accounts on Twitter, Bluesky, and Discord using password recovery options. It's unknown if this could also allow access to other accounts, including FA itself. With this in mind, it's a good idea to wait until the dust settles until further action is taken, but I'd say resetting your FA password when the coast is clear is a good idea - and retire that password entirely.
Update (22AUG2024): FA staff appear to be back in control of their Twitter account.
Further update (22AUG2024): FA staff are back in control of their registrar account, and traffic is being directed normally once again. All stolen external social accounts appear to be back where they belong. FA is once again open, though all sessions were voided to prevent session hijacking. The incident appears to have concluded, and it should once again be safe to visit FA.
