4 ms·

Clicking on a Facebook Scam to See What Would Happen

25 points by bhalp1 9y ago

Apocryphon 9y ago
Is this a regular thing, to see phishing or malware scams in Facebook ads?
- mcintyre1994 9y ago
  Yep, but you'll probably never see them. I never see them but I always see them on my mum's Facebook whenever I'm home. My guess is there's two main factors: 1) Abusing Facebook targeting to proxy for 'non-technical' in some way. 2) Presumably if you click Facebook ads you get more similar ones, for some criteria. So if you got them you wouldn't click, and they'd disappear. Facebook are terrible at policing this - I'd guess >50% of the stuff they're paid to show my mum is a blatant scam - if somebody spent 10 seconds looking at each ad I've seen there before accepting it they'd spot all of them. I've basically tried to show my mum how to identify something that will take her outside of the app (not that easy on the Android app) and told her never to click any of them. I'm surprised this isn't talked about very often, but they're clearly only being shown to the people who won't recognise them for what they are.
  - sofaofthedamned 9y ago
    I'm not on FB, but can you click in the corner of the advert and find out why you (or rather, your mum) was targeted? Is it demographic or interest based targeting?
    - rounce 9y ago
      I reckon it's demographic: older generation, generally less internet scam savvy, have assets worth stealing, etc. My mum also gets tons of these from sponsored ads, as well as her friends (also same demo) blindly sharing them (who knows if they click).
    - mcintyre1994 9y ago
      That's a really good point, I'll have to ask if we can try that next time! I just had a look at one of mine and the top line was "One reason you're seeing this ad is that Habito wants to reach people who may be similar to their customers." which is pretty vague. The next bit mentioned 18+ and in the UK, and a few others mentioned age too so maybe it'd at least give that much.
      - sofaofthedamned 9y ago
        Twitter is even worse with this. I block all advertisers, but they've recently added the ability to see why you were targeted - each of them states I was targeted because i'm in the UK, even for stuff that's only relevant to another country, Kenya was the last example. There is a targeting problem that helps TW/FB, or there is a reporting problem that helps nobody.
justboxing 9y ago
The memes on this story tie the investigation together.
brokentone 9y ago
Seems like the article is incomplete. Another hour or two of investigation, actually proving a malware connection would have been really interesting. TLDR: It's not a legitimate site, they're probably doing something silly, though not able to reproduce, and was able to find contact info on whois (assuming scammers don't know how to mask identities).
helmett 9y ago
if one knew how much money these people make doing this stuff, one would be tempted to do it too. Folks made millions doing this because Facebook is slow to ban the domains
had2makeanacct 9y ago
Anyone know how to execute a mail bomb? https://www.whois.com/whois/deltaa-com.us https://www.whois.com/whois/deltaa-com.us
Psilidae 9y ago
Aside from malware, this might just be trying to get a lot of likes on a facebook page. I'm not exactly sure how it works, but there's definitely a demand for pages with a large quantity of likes. I have a page that has 100,000+ likes and I get multiple messages every day inquiring to "buy" (read: steal) the page. So, a scam like this might just be trying to fill a page with likes for whatever market exists for well-liked pages.
kabes 9y ago
> Since there was no way I was going to Share the link, this was my stopping point. Note that you could share it with the visibility set to 'only me' and after confirmation delete it again.

25 points by bhalp1 9y ago

Apocryphon 9y ago

Is this a regular thing, to see phishing or malware scams in Facebook ads?

mcintyre1994 9y ago
Yep, but you'll probably never see them. I never see them but I always see them on my mum's Facebook whenever I'm home. My guess is there's two main factors: 1) Abusing Facebook targeting to proxy for 'non-technical' in some way. 2) Presumably if you click Facebook ads you get more similar ones, for some criteria. So if you got them you wouldn't click, and they'd disappear. Facebook are terrible at policing this - I'd guess >50% of the stuff they're paid to show my mum is a blatant scam - if somebody spent 10 seconds looking at each ad I've seen there before accepting it they'd spot all of them. I've basically tried to show my mum how to identify something that will take her outside of the app (not that easy on the Android app) and told her never to click any of them. I'm surprised this isn't talked about very often, but they're clearly only being shown to the people who won't recognise them for what they are.
- sofaofthedamned 9y ago
  I'm not on FB, but can you click in the corner of the advert and find out why you (or rather, your mum) was targeted? Is it demographic or interest based targeting?
  - rounce 9y ago
    I reckon it's demographic: older generation, generally less internet scam savvy, have assets worth stealing, etc. My mum also gets tons of these from sponsored ads, as well as her friends (also same demo) blindly sharing them (who knows if they click).
  - mcintyre1994 9y ago
    That's a really good point, I'll have to ask if we can try that next time! I just had a look at one of mine and the top line was "One reason you're seeing this ad is that Habito wants to reach people who may be similar to their customers." which is pretty vague. The next bit mentioned 18+ and in the UK, and a few others mentioned age too so maybe it'd at least give that much.
    - sofaofthedamned 9y ago
      Twitter is even worse with this. I block all advertisers, but they've recently added the ability to see why you were targeted - each of them states I was targeted because i'm in the UK, even for stuff that's only relevant to another country, Kenya was the last example. There is a targeting problem that helps TW/FB, or there is a reporting problem that helps nobody.

justboxing 9y ago

The memes on this story tie the investigation together.

brokentone 9y ago

Seems like the article is incomplete. Another hour or two of investigation, actually proving a malware connection would have been really interesting. TLDR: It's not a legitimate site, they're probably doing something silly, though not able to reproduce, and was able to find contact info on whois (assuming scammers don't know how to mask identities).

helmett 9y ago

if one knew how much money these people make doing this stuff, one would be tempted to do it too. Folks made millions doing this because Facebook is slow to ban the domains

had2makeanacct 9y ago

Anyone know how to execute a mail bomb? https://www.whois.com/whois/deltaa-com.us https://www.whois.com/whois/deltaa-com.us

Psilidae 9y ago

Aside from malware, this might just be trying to get a lot of likes on a facebook page. I'm not exactly sure how it works, but there's definitely a demand for pages with a large quantity of likes. I have a page that has 100,000+ likes and I get multiple messages every day inquiring to "buy" (read: steal) the page. So, a scam like this might just be trying to fill a page with likes for whatever market exists for well-liked pages.

kabes 9y ago

> Since there was no way I was going to Share the link, this was my stopping point. Note that you could share it with the visibility set to 'only me' and after confirmation delete it again.