11–20 of 28 posts
Presumably the 'AL' country code test was included so the Albanian "John Smith" could/can examine the live website without being directed straight to Google.
But a marketeer I recommend looking at scam email/ads from a professional POV. Quite often they are great examples of marketing and how to communicate effectively. Just please apply this to a more honest motive.
What confuses me is the (relative) sophistication of some of these scams juxtaposed with some really shoddy website designs that scream "scam" to me. When scammers and phishers learn to put together a semi respectable design or even simply copy the designs they are trying to imitate more precisely they would be far more successful.
Or perhaps it is a worst is better type of thing and the crappier designs convert better for their purposes. Hmm.
perhaps people more readily identify with a site written with the same spelling and grammar mistakes they use, and trust the site more over those "educated" sites where "proper grammar" and "correct spelling" are just lorded over you and rubbed in your face. the crap website might be a kind of kindred spirit, just waiting to befriend the intellectually downtrodden.
This style of advertising called "incentivized co-registration" (co-reg / co-reg path) (1) has been a long running plague - as far back as 2008 the FTC penalized ValueClick ~$3m (2) for this exact same thing as it's deceptive.
On the front-end you've got Facebook, Microsoft, and Google (to name a few) making money hand over fist letting these co-reg paths buy their media.
(As an aside Bing is well known to be the loosest with regulating compliant advertising which is just sad given that it impacts the MSFT brand.)
On the back-end you've got brands like Netflix, Nokia, Guiness, GAP, etc etc that lend themselves to being on the co-registration path and offering a variety of offers like "Join our newsletter etc" so they can then market to the consumers that say yes.
Again, great in concept - fill out your information once to enter for a "prize" and then select brand offers that you're interested in.
The problem is that most of the guys running the actual paths - buying the media etc - are small affiliate marketers. These are one to five man teams that slap together a variety of these co-reg offers from the "legit" co-reg company APIs.
So you'll see the big co-reg companies bragging about how they power the USAToday.com registration process, but the reality is many of them make the bulk of their revenue through their API sets and affiliate programs, which they leave damn-near unregulated (unless put under the microscope).
So every now and again the FTC hammers a few of these small timers, but the reality is an affiliate - doing "ok" - can make anywhere from $10 - 100k/mo in profit just doing what I describe above - build some direct-response landing pages, pull brand offers from the co-reg company apis, and buy media from companies that love to sell it, and don't look too hard for reasons not to.
So anywho I love getting on my soapbox but it's insane how many huge companies benefit from these scams, and how simple it is for them to have deniability due to the ecosystem of using these small timers on the front end.
(1) A great breakdown of "what is" co-reg advertising http://www.coregmedia.com/demos/demo-pub.php
(2) FTC Settles w/ValueClick http://www.ftc.gov/opa/2008/03/vc.shtm
jerk-off gesture
2011 Scam report by Australian Government is here: http://www.accc.gov.au/content/index.phtml/itemId/1039349 I've passed your research onto the authors of this report, thanks for sharing it.
What confuses me is the (relative) sophistication of some of these scams juxtaposed with some really shoddy website designs that scream "scam" to me. When scammers and phishers learn to put together a semi respectable design or even simply copy the designs they are trying to imitate more precisely they would be far more successful.
I've spent ~15 years in online advertising and this sure isn't limited to just being a "Facebook scam". This style of advertising called "incentivized co-registration" (co-reg / co-reg path) (1) has been a long running plague - as far back as 2008 the FTC penalized ValueClick ~$3m (2) for this exact same thing as it's deceptive. On the front-end you've got Facebook, Microsoft, and Google (to name a few) making money…
The same structure drives multi-level marketing, off-shoring/outsourcing manufacturing/recycling/garbage-hauling to sweatshops/polluters/mafia, and the junk mortgage bubble / global financial crisis.
I'm glad to see this blogged about as it was on my todo list. I have numerous previous examples of this scam as well if people want to compare and contrast (free sunglasses [Oakleys], free headphones [Beats by Dr Dre], etc). What annoys me most about this is the scam is only spread through exploiting human nature and not advanced technology. The code is literally almost exactly the same each time yet nothing has been…
In cases like this, you're right that there are often obvious content patterns. However, enforcing on or detecting those doesn't really scale, as they're trivial for the attacker to change. Instead, we try to focus on aspects of an attack that are much more expensive for the attacker to change. One component of our systems that detect this does involve looking at metadata about URLs, and running it through some machine learned classifiers (you're correct that simply using bit.ly is insufficient to stop us).
Regardless, we've taken care of this particular instance of the attack and are always working to systematically improve our detection and mitigation systems. Let me know if you're interested in helping us out in this effort!
The redirects are generating fake ad clicks for the scammer, it's very common and probably the main source of revenue for this "campaign".