Safety around this ARG: fan sites, impersonation, and what to type nowhere
ARGs attract fan sites, tribute sites, and impersonation sites, and Gravity Falls-adjacent ARGs attract all three. This page is the practical one. It exists because the most common real-world risk around a project like this is not a spoiler or a puzzle difficulty, it is a fake site asking for money or credentials.
The one rule that prevents most of it
Navigate to the ARG yourself by typing the address directly, or reach it from a link on a page you already trust. Do not click through from a search result, a social post, a video description, or a Discord message. Impersonation sites for ARGs rank aggressively for exactly the queries a curious person types, and the sponsored result is often the fake one.
Read the domain, not the logo. A page can reproduce a logo, a colour scheme, and a pixel-perfect terminal interface while sitting on a completely unrelated domain. Logos and interfaces are the easiest things on the internet to copy, so they carry almost no evidential weight.
Things no legitimate ARG terminal needs from you
Nothing on this ARG, and on essentially any alternate reality game, requires any of the following. If a site that presents itself as part of it asks for any of them, close the tab.
- Payment, card details, bank details, or a gift card or cryptocurrency demand, including "unlocking" or "verification" tiers.
- A username and password for any account, especially an email, social media, or Discord account.
- Identity documents, a date of birth, a government ID, or a selfie as an "age verification" step.
- An app, browser extension, or executable file that has to be installed to "view the real content".
- Notification permission prompts, which are a standard precursor to browser push-notification abuse.
The general rule underneath all of these: a work of fiction cannot lawfully or technically need your real-world identity in order to show you a drawing of a triangle with a top hat.
Malvertising and fake download buttons
The classic pattern in this space is a convincing replica of the terminal with an overlay button, a countdown timer, or a "you are the 1,000,000th visitor" message that leads to an ad script, a subscription trap, or a malware payload. Our fan-site authenticity page covers the specific tells, and they are specific to how these replicas are built.
If you have already entered something
- Payment details: contact your bank or card issuer immediately and ask about a reversal or a fraud dispute. Speed matters more than certainty here.
- A password: change it on the real service, not through a link in the message that got you here. If you reused that password anywhere else, change it there too.
- An app or extension you installed: remove it, then run your operating system's malware or security scan, and re-check browser extensions for anything you do not recognise.
What is legitimate
Official presence for Alex Hirsch's own projects is verifiable, and the pattern is consistent. His real ARG sites are self-contained web experiences you reach directly. His books are sold through Disney Books and normal booksellers, never through a link on an ARG terminal. Nothing is sold inside the terminal experience. If a page inside the fiction is selling you something, that is part of the fiction, not an offer.