3 ms·

TXT records are useful for OSINT. I've used them to tie together fake business listings on Google Maps. It also allowed me to tie the listings directly to the m

TXT records are useful for OSINT. I've used them to tie together fake business listings on Google Maps. It also allowed me to tie the listings directly to the marketer responsible.

djbusby 3y ago
Where is the blog post about this?
- TrendyCPU 3y ago
  No blog post. But, since you and another have requested I'll just write a comment. I work for a small, local, family company. I maintain the websites and do some of the marketing. We've noticed an uptick in websites for fake businesses and fake business listings in our area/industry in the past 3-4 years. The goal is to generate leads which can be resold to local contractors--usually without the customer knowing. It's a scheme called "rank and rent." A few months ago, I noticed a new listing in our area. I started digging into the SEO spam for it. There was a website, a couple of one-episode podcasts, social media profiles, business listings, PDF spam, and more. Looking into the HTML source of the site, I discovered some JSON-LD for a completely different company. I looked up the company on Google Maps. Sure enough, there was a listing. And the website was using the same theme as the one I was digging into. I decided to pull the DNS records. They both used the same Cloudflare NS. Not a smoking gun, but interesting. Then when I pulled the TXT records, I noticed both used the same IP for the SPF record. Bingo! A quick cURL resolving the domains to the IP, and I had proof they were hosted on the same shared hosting server. With the IP, I was able to do a reverse lookup for other sites hosted on the same server. This netted me several domains that also used the same theme and had Google Maps listings (GBP). The money result was several marketing firm domains. One turned out to have a GBP. It had videos and photos the person used to verify the listing. Fortunately, it had the marketer speaking in the video as well. That voice sample allowed me to compare it to the podcasts mentioned above. Aside from him faking an accent, it was definitely the same guy. I've since discovered ~30 such podcasts for his different listings. The other marketing domains were even more interesting. They were also run by the same guy. Again, verified via voice in a video on these sites. He used these websites to recruit people for "social media gigs." The gigs were setting up Google Business listings in their area. They'd setup a listing, get the postcard with a verification code, pass it off to the marketer, and he'd pay them $50-100. The kicker was a Google form on the recruitment page. It asked if the person would be willing to leave 5-star reviews for businesses they'd never done business with for $20. I went back to Google Maps and started bouncing through people who'd left reviews. That opened up a whole world of listings that I hadn't known about. At present, I'm over 80 listings which can be tied back to him. I've also identified several websites that don't have GBP listings yet thanks to the TXT records and reverse lookups.
Diederich 3y ago
I'd love to read more about this!
- TrendyCPU 3y ago
  I left a comment in the thread. Feel free to ask questions. Though, I'm cautious about giving too many details as I plan to report the guy to the AG in his state.

TXT records are useful for OSINT. I've used them to tie together fake business listings on Google Maps. It also allowed me to tie the listings directly to the marketer responsible.

djbusby 3y ago

Where is the blog post about this?

TrendyCPU 3y ago
No blog post. But, since you and another have requested I'll just write a comment. I work for a small, local, family company. I maintain the websites and do some of the marketing. We've noticed an uptick in websites for fake businesses and fake business listings in our area/industry in the past 3-4 years. The goal is to generate leads which can be resold to local contractors--usually without the customer knowing. It's a scheme called "rank and rent." A few months ago, I noticed a new listing in our area. I started digging into the SEO spam for it. There was a website, a couple of one-episode podcasts, social media profiles, business listings, PDF spam, and more. Looking into the HTML source of the site, I discovered some JSON-LD for a completely different company. I looked up the company on Google Maps. Sure enough, there was a listing. And the website was using the same theme as the one I was digging into. I decided to pull the DNS records. They both used the same Cloudflare NS. Not a smoking gun, but interesting. Then when I pulled the TXT records, I noticed both used the same IP for the SPF record. Bingo! A quick cURL resolving the domains to the IP, and I had proof they were hosted on the same shared hosting server. With the IP, I was able to do a reverse lookup for other sites hosted on the same server. This netted me several domains that also used the same theme and had Google Maps listings (GBP). The money result was several marketing firm domains. One turned out to have a GBP. It had videos and photos the person used to verify the listing. Fortunately, it had the marketer speaking in the video as well. That voice sample allowed me to compare it to the podcasts mentioned above. Aside from him faking an accent, it was definitely the same guy. I've since discovered ~30 such podcasts for his different listings. The other marketing domains were even more interesting. They were also run by the same guy. Again, verified via voice in a video on these sites. He used these websites to recruit people for "social media gigs." The gigs were setting up Google Business listings in their area. They'd setup a listing, get the postcard with a verification code, pass it off to the marketer, and he'd pay them $50-100. The kicker was a Google form on the recruitment page. It asked if the person would be willing to leave 5-star reviews for businesses they'd never done business with for $20. I went back to Google Maps and started bouncing through people who'd left reviews. That opened up a whole world of listings that I hadn't known about. At present, I'm over 80 listings which can be tied back to him. I've also identified several websites that don't have GBP listings yet thanks to the TXT records and reverse lookups.

Diederich 3y ago

I'd love to read more about this!

TrendyCPU 3y ago
I left a comment in the thread. Feel free to ask questions. Though, I'm cautious about giving too many details as I plan to report the guy to the AG in his state.