31–40 of 97 posts
I've noticed on some scam forums and subreddits I frequent that scammers have been using target site's own support searches to redirect users to scam phone numbers. On both Ticketmaster and Facebook, and many other sites, when you perform a search on their support site it spits back your query in big letters at the top of the page. If you craft the correct search and then buy Google Ads pretending to be Ticketmaster,…
Earlier quoted context omitted.
So, I craft a search where the search query is “call 1 800 scam”, then I buy a google ad with key word of “ticketmaster help”, the ad links to real ticketmaster with my query, and google shows that ad to someone having trouble and hey presto they call my scam line at 4 quid a minute from their mobile? Yuck all round. I mean ticketmaster is just a sin eater for greedy popstars but yuck ..
But why does google allow unverified owners of a domain to buy ads for it? Surely only ticketmaster or agencies approved by ticket master should be allowed to do this?
I've noticed on some scam forums and subreddits I frequent that scammers have been using target site's own support searches to redirect users to scam phone numbers. On both Ticketmaster and Facebook, and many other sites, when you perform a search on their support site it spits back your query in big letters at the top of the page. If you craft the correct search and then buy Google Ads pretending to be Ticketmaster,…
So, I craft a search where the search query is “call 1 800 scam”, then I buy a google ad with key word of “ticketmaster help”, the ad links to real ticketmaster with my query, and google shows that ad to someone having trouble and hey presto they call my scam line at 4 quid a minute from their mobile? Yuck all round. I mean ticketmaster is just a sin eater for greedy popstars but yuck ..
Here's a real example from the same thing happening on FB (don't call that number) https://i.redd.it/w9htjqflgjle1.jpeg
Among the common vulnerabilities listed: > Outdated Wordpress plugins and CMS systems No surprise, having worked in edu the following scenario was very common: 1) Researcher gets a grant for a project 2) Grad student sets up a Drupal site for the project 3) Things are maintained and updated for a couple of years 4) Grant runs out, project wraps up, student graduates, everyone forgets about the server which sits unatt…
At my old university ~15 years ago, all IPs of all computers were public IPV4 addresses . Any computer plugged in to any ethernet port on campus was given such a "quasi-static" IP address. All normal ports were open - ssh, http(s), you name it. It was the OG zero trust architecture.
Earlier quoted context omitted.
So, I craft a search where the search query is “call 1 800 scam”, then I buy a google ad with key word of “ticketmaster help”, the ad links to real ticketmaster with my query, and google shows that ad to someone having trouble and hey presto they call my scam line at 4 quid a minute from their mobile? Yuck all round. I mean ticketmaster is just a sin eater for greedy popstars but yuck ..
But why does google allow unverified owners of a domain to buy ads for it? Surely only ticketmaster or agencies approved by ticket master should be allowed to do this?
Source: I've also thought this was ridiculous and asked someone working on the adsense team. Apparently tried enforcing some domain verification mechanism in an experiment, but most companies and agencies struggled to get the verification done and of course the $ metrics on this launch dropped, causing execs to force them to stop.
> Norton, Kaspersky, Zscaler, F-secure, NordVPN, Virustotal, Palo Alto: all of them marked these links as safe. This is sad to see, these tools are forced down so many companies in name of "compliance" while totally not worth the maintenance and cost overhead. Apparently they haven't got any better in the last decade.
I've noticed on some scam forums and subreddits I frequent that scammers have been using target site's own support searches to redirect users to scam phone numbers. On both Ticketmaster and Facebook, and many other sites, when you perform a search on their support site it spits back your query in big letters at the top of the page. If you craft the correct search and then buy Google Ads pretending to be Ticketmaster,…
Wow. Programmatic SEO and its consequences. Genius...
If only the Ticketmaster team could show ads on that domain, all these ads would have to go through their marketing team (and use ticketmaster's budget, with all the accounting and invoicing this requires), which would massively slow things down.
Instead, it seems that Google has some kind of protection where ads mentioning Ticketmaster must link to their official domain, to prevent things like this from happening. The scammers just found a way for that domain to display arbitrary text.
Is it just me or is cybersecurity... Calming down? I feel like a few years ago there was constant news of ransomware, intrusions, vulnerabilities, etc, but more recently the defensive side seems to have the upper hand.
Not particularly. The only thing I have noticed in the past decade is the decline of the "American Hacker". Most groups are foreign but will partner with younger Americans for social engineering (ex. Scattered Spider). You just don't have people like Albert Gonzalez/Stephen Watt in America now. However, I suspect that many American hackers have shifted to targeting overseas countries that are not friendly with the US…
I don't know what the state of big corps netsec is today but these guys had it somewhat easy. They got initial access through weak wifi then pivoted with SQL injects and such.
I've noticed on some scam forums and subreddits I frequent that scammers have been using target site's own support searches to redirect users to scam phone numbers. On both Ticketmaster and Facebook, and many other sites, when you perform a search on their support site it spits back your query in big letters at the top of the page. If you craft the correct search and then buy Google Ads pretending to be Ticketmaster,…
