How to tell an official Alex Hirsch project from a fan site or a scam

Every ARG attracts three kinds of site: the real one, fan projects, and impersonation sites built to harvest credentials or payment. The first two are harmless. The third is the reason this page exists.

Test 1: did you type the address, or did you click it?

This single question removes most of the risk. Reach an ARG by typing its address or from a link on a source you already trust. Never reach one from a search result, and read sponsored results with particular suspicion, because impersonation sites for ARGs bid aggressively on exactly the queries a curious person types. A link in a video description, a social post, or a Discord message is not evidence of anything.

Test 2: does the interface load, or does it only look like it loads?

Most fakes are static images. Load the page and click. If what you are looking at does not respond to a click, does not react to typing, and does not change when you interact with it, you are looking at artwork, not an application. This works well for the Gravity Falls ARGs in particular, because the real ones are JavaScript-dependent and visibly slow, which is the opposite of a smooth static replica.

A second tell in the same family: real interfaces have load jank. They render in stages, some assets appear late, and some things are broken. Fakes are clean. If everything works perfectly on the first paint, be suspicious.

Test 3: inspect the asset directory

Unfinished work is the strongest signal of authenticity, and it is hard to fake convincingly. The real terminal serves a set of assets whose filenames include a "wip" prefix, covering a bubble, an art piece, a paper document, a second window, and a tooth, alongside stub pages for a note, a "cheat death" entry, an Atlantis entry, and a creature entry. That is the signature of a work in progress. A replica site will typically ship only the polished-looking pieces, because the creator of the fake is copying the idea and not the mess.

Loading the page and looking at what the browser fetches is a legitimate, non-invasive way to check this.

Test 4: the request test

Nothing legitimate here will ever ask for any of the following. If a page that presents itself as part of this universe asks for one of them, close it.

• Payment, card or bank details, gift cards, or cryptocurrency, including to "unlock" content or "verify" a fan account.
• A username and password, especially for email, social media, or Discord.
• Identity documents, a date of birth, or a selfie as "age verification".
• An app, extension, or executable to be installed "to view the real content".
• Notification permission, which is a standard precursor to push-notification abuse.

The reasoning is simple: a work of fiction cannot technically need your real-world identity in order to render a drawing of a triangle in a top hat.

Test 5: does the commerce follow the official route?

Official commerce for Hirsch's books runs through Disney Books and ordinary booksellers. Nothing is sold inside an ARG terminal. If a page inside the fiction appears to be selling you something, that is part of the fiction, not an offer to you. And a "buy access now" button anywhere on a purported ARG site is a red flag, because ARGs of this kind have never had paid access.

What to do about the copyright version, and what not to do

Unofficial archives and rips of a franchise are common enough that finding one is not evidence of anything in either direction. They are a different problem from impersonation: the practical harm is legal rather than financial. We do not link to any, and the legal options are the complete series on Disney+ and the Shout! Factory complete-series box set, which is the only home for the 2010 pilot and the Cipher Hunt deleted scenes. Our companion site's where to watch page covers it.

The safety page has the remediation steps if you have already entered payment details, a password, or installed something.