spam – Terence Eden’s Blog

Grinding down open source maintainers with AI

@edent — Mon, 07 Jul 2025 11:34:09 +0000

Early one morning I received an email notification about a bug report to one of my open source projects. I like to be helpful and I want people who use my stuff to have a good time, so I gave it my attention. Here's what it said:

😱 I Can't Use On This Day 😭
Seriously, What’s Going On?! 🔍
I’ve been trying to use the On This Day feature, but it’s just not working for me! 😩
Every time I input my details, it says I have no posts for today, even though I know I’ve posted stuff! 🧐
Here’s My Setup: ⚙️

Python 3.x 🐍

Access token fully generated (I triple-checked!) 🔑

Attempted on multiple instances but still nothing! 😩😩

Could It Be a Bug? 🤔
I’m really starting to doubt my posting history! 😳
Is it supposed to show only specific types of posts?
I’ve made some pretty epic posts before! 💥💬

Documentation Confusion 📚
The README says to register for an access token but doesn’t clarify if it factors into this feature! 🤔❓
Did I miss something REALLY important?!
Help me figure this out, please!!! 😱

Feature Suggestion 💭
If this is broken, can we at least have a debug mode to log what’s happening! 😬
I need to know if it’s truly my fault or the code’s! 🔍🛠
Thanks for looking into this TRAGIC situation!!! 😭💔

P.S. My friends ARE posting on this day and their instances work!! 😤
I feel so left out!! 😟

Let’s get this sorted ASAP! ⚡

OK, that's a lot of Emoji - too much even for me! But if one of my users needs help, I'm there for them! As the feature works for me, I decided I'd ask for the output of the app. Maybe there'd be a clue in the minimal debugging output it had.

I clicked on the link to the Codeberg repository and was hit be a 404! What? I clicked on the link to the user "simpleseaport2" but that was also broken.

"Seriously, What’s Going On?! 🔍"

It looks like Codeberg has been hit by a wave of spam bug reports. I read through the bug report again, slightly more awake, and saw just how content free it was. Yes, it is superficially well structured, the Emoji are a bit over-the-top but not the worst I've seen, and the emotional manipulation is quite insidious.

A few weeks later, I got a bug report to a different repo. This one was also deleted before I could reply to it, see if you can spot that it is AI generated:

I've been trying to use the Threads tool to visualize some conversations but I'm running into a serious problem, and it's really frustrating!
When I input the URL for a post with a substantial number of replies, the script seems to hang indefinitely. I've waited more than 15 minutes on a couple of occasions, and nothing seems to happen. This is not what I expected, especially since the README mentions large conversations may take a long time, but doesn’t specify any limits or give guidance on what users should do if it doesn’t respond at all!
It's unclear what's actually happening here. Is the script failing silently? Is it the API timing out? Why isn’t there any sort of progress notification built into the tool? It feels like a complete dead end.
Can you please add some kind of error handling or logging feature to the Threads script? It would be helpful if it could at least inform the user when a timeout occurs or if the API response is simply taking too long. Additionally, could you clarify the maximum number of replies that can be handled? It’s really inconvenient to have no idea if the script is still processing or if it’s just broken.
Thanks for addressing this. I hope to see improvements soon.

The emotional manipulation starts in the first line - telling me how frustrated the user is.
It turns the blame on me for providing poor guidance.
Then the criticism of the tool.
Next, a request that I do work.
Finally some more emotional baggage for me to carry.

I'm not alone in getting these - other people have also received similar spam

To be fair to Codeberg, they are under attack and are trying to stop these specious complaints reaching maintainers.

Post by @Codeberg@social.anoxinon.de

View on Mastodon

But, still, search the socials and you'll find a stream of frustrated developers.

Woke this morning to my first ever AI generated spam issue on a repo. Got it via email. When I went to check it out at Codeberg, it had already been moderated. Wonder how many others were affected. I immediately knew it was AI spam due to the overuse of emojis…🎉

[image or embed]
— Jeff Sikes (@bsky.box464.social) 24 April 2025 at 15:07

What's Going On⁉️

I can only think of a few possibilities - none of them particularly positive.

Attacking the viability of CodeBerg - make users abandon it for a different platform.
Attacking the attention of developers - make them unwilling to give attention where it is actually needed.
Attacking the integrity of users - make them less likely to receive help because they are mistaken for AI.
Maybe it is just a bored kid or an unethical researcher. Trying to find the limits of what a maintainer will recognise as spam?

Either way, AI bug reports like this are about as welcome as a haemorrhage in a jacuzzi.

What's up with this "Please add me on WhatsApp" robocall spam?

@edent — Sat, 31 May 2025 11:34:18 +0000

Over the last few weeks, I've received several calls which all have the same modus operandi. A disembodied robotic voice tries to get me to connect on WhatsApp.

https://shkspr.mobi/blog/wp-content/uploads/2025/05/add-me-on-whatsapp.mp4

Some of the voices are reasonable facsimiles of human voices (like the above) and some are just garbage.

🔊

💾 Download this audio file.

The voice clip plays and the call immediately terminates.

What I can't understand is how this can possibly be effective from the scammers' point of view. On receiving the call the victim must…

Decided to answer from an unknown number.
Listen to the message and decide it is legitimate.
Go the their phone's dialler app.
Copy the caller's phone number.
Open WhatsApp.
- Install WhatsApp if they don't have it already
Create a new contact - giving a name - and pasting the number.
Engage with the contact.

That's a lot of effort based on… what? A vague offer? There's a little bit of a curiosity gap but not much. It's hardly "add me on WhatsApp or we'll release the photos we have of you" or "you've won the lottery, add me on WhatsApp to get the funds", or "This is the CEO of your company, urgently add me…".

I guess that if a spammer is able to send out thousands of these messages then they might be able to attract a couple of people to engage with them. There's no easy way to report a spam account to WhatsApp unless you've engaged with it.

I also assume that WhatsApp will see that you were the person who initiated WhatsApp contact - which makes them less likely to think the scammer is the problem.

I am just fascinated to see if this scam can possibly be effective. Generating fake voices is free, as is placing short calls. WhatsApp accounts are also free and easy to automate. But are there really that many people willing to go to the effort of adding a new contact based on so little information?

Obviously, all spam is a numbers game. If the message reaches someone receptive to a robocall, they're less likely to query the scam. And, yes, I know that you're a very clever boy and don't answer unknown numbers - but in the real world people get calls from hospitals, recruiters, and friends with new numbers.

If you're a spammer and have found this approach effective - please leave a comment!

Update! July 2025. A new variant. Same basic message, but a much more natural sounding voice. I wonder if they're using real people now?

🔊

💾 Download this audio file.

Review: AntiSpam Bee WordPress Plugin ★★★★☆

@edent — Mon, 19 Jun 2023 11:34:28 +0000

Someone recently complained that using JetPack's Akismet anti-spam plugin wasn't very privacy friendly.

So, because I take every minor complaint as a personal rebuke, I decided to switch to AntiSpam Bee - an open source and local antispam solution.

And... it's pretty good! There is the occasional false negative - but not significantly worse than JetPack.

Most of the false negatives are from non-English language comments:

There are settings so that you can reject comments which aren't in your native language. But that comes with privacy implications.

I didn't spot any false positives - but I get hundreds of spam comments per day.

It's a little more fiddly than Akismet. But, as a power user, I appreciate that. It's also less reliant on a centralised service - who knows what weird AI grab Akismet will do with all the comments it moderates?

You can grab the source code from GitHub

Algorithm Induced Alcoholism

@edent — Wed, 09 Nov 2022 12:34:38 +0000

I like beer.

I like the Internet.

What if I could get beer using the Internet?!?!

A few years ago I purchased a mixed crate of beer online. I unticked all the checkboxes for marketing messages - but incautiously allowed them to send me special offers.

Every couple of months, they'd send me an email offering discount beer. And I'd ignore it. Mostly because I was still slowly working my way through the last crate.

But one day their marketing algorithm obviously decided that I was about to become a lost prospect and sent me an irresistible offer. "We miss you! Please enjoy a crate of 36 craft beers for £40."

Nice! I certainly won't look a gift-beer in the bottle. So I grabbed the bargain and stuck the tinnies in the cupboard.

And then the algorithm went haywire.

Every day - every single day - since placing my order, I've received a marketing message from the company. "Don't miss out on this exclusive case!" or "Our top beers - hand picked for you!" or "URGENT! Last few cases remaining at this price!" or "The ULTIMATE taste test - which will you choose?" or "20% discount if you order TODAY" or "Christmas is coming - stock up now!"

I get it. The CRM has detected that I'm a live prospect and willing to spend money - therefore they must capture my value before I churn. I don't know if they know how quickly I can drink 36 beers. I don't know if they know how much shelf space I have. And I don't know if they know that I dislike being bombarded with adverts.

What I do know that they know is the UK rules around advertising of alcohol promotions.

When it comes to consumer promotions with a multiple purchase mechanic promoters need to ensure that the number of items that need to be bought does not encourage consumers to exceed Department of Health guidelines for safe drinking and they should keep up to date with these guidelines. They should also ensure that the duration of the promotion is long enough to allow consumers to participate without drinking excessively or irresponsibly

Interestingly, all the marketing emails came to me in the evening. Presumably because the guidelines also say:

Alcohol promotions that could encourage a style of drinking that is unwise, for example encouraging people to drink at breakfast or early in the day, are likely to be problematic

There's an old complaint about being shown adverts for things you've already purchased. It is mostly down to lazy marketers using retargeting and is usually little more than an annoyance. But continually messaging people encouraging them to buy alcohol feels like it could cause harm.

Alcohol can be addictive. As can A/B testing your customers to see which messaging resonates with the target demographic. Advertisers - know your limits!

I know you might think I'm exaggerating - but here's a fortnight's worth of emails from online beer merchant Flavourly:

I hadn't checked the inbox for a month, hence the build-up of crap before I could unsubscribe.

Why can't Twitter stop the "Twoo Fun / Ask For Me" spam?

@edent — Sat, 22 Oct 2022 11:34:42 +0000

Back in June, I noticed a pretty insidious piece of Twitter spam. The "twoo.fun" website was claiming that it could tell you who visited your Twitter profile.

That's pretty enticing! It's what LinkedIn uses to drive its premium product. Perhaps it would tell me if a potential employer was looking at my profile? Or if my crush kept visiting it!??!?!?

So people visited the website and signed in with their Twitter account. Whereupon the app started posting spam. Something which looked like this:

The Twitter API does not have the functionality to record visitors to a profile. This app is lying to users. But it tells an interesting lie. And that encourages people to click on the spam and log in with their own account.

As soon as I spotted it, I reported it via the Twitter Insiders' programme. And, to their credit, they managed to shut it down pretty quickly.

And then it popped up again.

And Again

And again.

It has been grimly fascinating to see how it spreads through different communities and different language groups.

You can watch it spread in realtime using https://twitter.com/search?q=Twoo.fun&src=typed_query&f=live

It has since metastasised into a similar scam called AskForMe.me - again, you can see it worm its way through communities at https://twitter.com/search?q=askforme.me&src=typed_query

In this case, the spam specifically mentions other users and posts fake statistics about how long they've been viewing the profile.

I keep reporting this to Twitter. And they keep shutting it down. And it keeps popping back up!

I don't have access to Twitter's systems - but it seems to me like there are some easy ways to curtail this scam. At the very least blocking those two domains would force the spammers to keep moving to new hosts. Perhaps Twitter could look for new apps which suddenly start posting messages which are quickly marked as spam. Or they could do some fancy machine-learning to identify similarly scammy images.

At the moment, we don't know what the end-game is for this spam. Maybe is it "just" a worm and someone is having a giggle seeing how many people they can infect. Perhaps it is harvesting accounts hoping to sell them to other spammers. Or it could be slurping down the social graph for other nefarious purposes.

Either way, this has been going on for at least five months! I think I've done what I can to inform Twitter. In the meantime, I urge you to warn your followers about this spam.

If you've been infected with this Twitter scam, please visit https://twitter.com/settings/connected_apps to remove it from your account.

Update! Looks like this spam has been doing the rounds since 2018!

There's no way to report spam on Google Drive

@edent — Mon, 04 Apr 2022 11:34:50 +0000

Recently, I've been getting a lot of spam notifications from Google Drive. Here's a sample:

The notifications come direct to my Android phone via the Drive app - they don't appear in my Gmail spam folder. There is no way to report the abuse.

If I go to the list of notification in the Android apps, there's no option to report that the notification is spam.

If I'm stupid enough to open the spam file, there is a context menu but - again - no way to report spam.

What about the detail pane? That'll have something, surely?

Nope! Nothing.

Let me be me clear, just as Zawinski's law says "Every program attempts to expand until it can read mail" - so every Google app expands to be a vector for spam.

There's also no way to report the spam from the web version of Drive. The notifications simply don't appear there.

In typical Google fashion, there's no support forthcoming for users who are inundated with these messages. So the poor users howl into the void - desperate for Google to respond. But all Google will do is spout platitudes.

Tedious, isn't it?

You will notice that all the links point to sites which don't actually help! When people ask Google how they report spam - Google are utterly silent.

I think it is clear that Google have lost control of their platforms. There is no central authority in Google who is in charge of ensuring a consistent and pleasant user experience. Their customer service agents aren't empowered to actually help users - nor can they escalate emergent issues to management.

As an abusive monopoly, there's very little incentive for Google to fix this.

So, like a mug, I'm attempting to catch the passing eye of some Google employee who can raise this internally.

Porn Spam on Google Maps

@edent — Sun, 15 Aug 2021 11:22:03 +0000

User Generated Content is great, innit? As a company, I want users to submit photos, so I don't have to do any content curation. Moderation? Nah mate, stick some AI on there to filter out anything offensive and we're golden.

*sigh*

What could this possibly mean? I searched for Loch Ness on Google Maps.

Oh! Hey! Someone's posted a 360 photosphere from the very centre of the Loch!

Huh... That doesn't look like the beautiful Scottish countryside. I wonder what happens if I pan around...?

🚨 🍆 🚨

(Redacted for his privacy and your comfort.)

It's pretty easy to upload spam to Google Maps. I suspect that whatever BIG DATA ARTIFICIAL INTELLIGENCE ALGORITHMS they have simply don't work on panoramic photos.

Anyway, I reported it - yay for doing unpaid labour for a megacorporation - and it has vanished.

The thing is, this isn't a mistake or a glitch. There's a user who literally enjoys repeatedly posting these photos to scenic locations.

I know the "wisdom of the crowds" means that large companies don't have to worry about bad actors⸮ But perhaps Google could spend a little of its time and money moderating the content it displays. If one determined user is able to gain this many views - what could a more malicious user accomplish?

Be seeing you!

Is this a banking scam SMS?

@edent — Sat, 17 Jul 2021 11:35:07 +0000

Earlier this week, my holiday was interrupted by a sophisticated SMS scam. Rude! Let's take a look at it.

Let's take a look at all the ways we can tell it is a scam.

Firstly, and most obviously, I am not a customer of Lloyds Bank! But these scammers send out to multiple people hoping to catch victims.

Secondly, I've not made a complaint to Lloyds! But, again, scammers know that plenty of people have. So this adds a touch of authenticity. If you were a Lloyds customer who had recently complained - you're now primed to accept the scammer's call and treat it as legitimate.

Thirdly, that phone number. If you call it, a recorded voice says "Welcome to customer services..." Whose customer services? It doesn't say "Welcome to Lloyds". This is likely a number that scammers put on texts claiming to be from HSBC, Lloyds, NatWest. Cheaper for them to have a single phone number.

Fourthly, the reference number. It is just my phone number! That's an unusual reference number for a bank.

There's some weird spacing between "Mr" and "Eden" - not what I'd expect from a professional message.

What do you think of the SMS? Would you flag it as spam? I asked my Twitter followers and their responses were unanimous.

A few minutes after receiving the SMS, I got a call from a Peterborough number - not the 0800 number. The phone number was flagged as suspicious (read the number's reviews).

After the customary pleasantries, the voice at the end of the phone said "Can you just confirm your name and address for me please?"

I replied that I didn't give that information out to cold callers.

"Completely understandable sir. If you check your messages, you'll see an SMS from us scheduling the call. Did you receive that?"

I replied that I get lots of spam texts and that I couldn't be sure it was legitimate.

We reached an impasse.

With a little subtle social engineering on my part, I found out the nature of the complaint. And then I realised... it was a legitimate call!

A few months ago, I'd complained to Halifax Bank that they were sending letters to someone who didn't live at my address.

The 0800 phone number is owned by Halifax

Halifax are part of Lloyds Bankings Group.

The geographic number I received a call from is the Lloyds outbound number.

In my defence - this did have most of the Hallmarks of a scam! Lloyds have tried to do the right thing by alerting me that the call is coming. They've provided a trusted phone number for me to call if I am concerned. They've given me the name of the caller, and a reference number.

But these are all things a scammer can do as well!

Lloyds could have made this better. Does the average user know that Halifax is part of Lloyds? I didn't. Why didn't the call come from the number that they'd sent in their text? Would a link to a simple URl like lloyds.com/contact have reassured me? How about lloyds.com/complaint/ref/123...?

Instead, several silly mistakes and my unhealthy paranoia collided and convinced me it was a scam.

What's the solution here? Sure, Lloyds can up their game - but a canny scammer can just tweak the wording and send out a convincing forgery. We can all abandon SMS and move to some cryptographically signed service which no one can use properly. We can hope that mobile networks crack down on SMS spam and only let legitimate messages through. Or users can dial down their paranoia - and hope for the best.

But, sadly, it seems that trusting messages from financial services are all but impossible right now.

Why spam calls come from similar numbers to your phone number

@edent — Mon, 05 Jul 2021 11:17:51 +0000

In the last few months, I've received dozens of spam calls which appear to come from a similar phone number to mine.

If my number is 07700 900 123 I get calls from 07700 900 124 or 07700 900 456

Here's my working theory on why spammers do this. Americans.

In the UK, there's a separate "area code" for mobile phones. If a number starts 07 then it is mobile (it's a bit more complicated than that).

In the USA, there's no cellular prefix. If you buy a SIM card in Las Vegas, you'll probably get a 702 number - at least, I did when I last visited.

Some of the area codes in the USA cover tiny geographic areas.

Spammers know this. They bet that if they call +1-555-867-5309 from +1-555-867-5409 the person will believe the spammer is local to them. Possibly even a neighbour. It is a weak form of social engineering attack. You're more likely to trust someone local than a distant stranger.

In the UK this doesn't work. Not because we don't trust our neighbours, but because our mobile numbers aren't tied to a specific geography.

Cultural hegemony can be an effective anti-shibboleth!

My solution to spam calls

@edent — Sun, 30 May 2021 11:05:07 +0000

Like most of you, I'm inundated with spam calls. So I have a new solution. When an unknown number calls me, they get routed to this audio file.

🔊

💾 Download this audio file.

This was created with Amazon Polly which is free for casual use. I was pretty impressed with the voice quality. Although there are limits to how well you can control the speed and intonation.

While there are a number of accents available, there are only a small number of distinct voices in British English.

Type your text, choose your voice, listen in the browser, then download the audio.

Using SipGate to set up a BANANAPHONE!

@edent — Thu, 27 May 2021 11:40:18 +0000

Like many of you, I'm inundated with spam calls. I've suffered endless car accidents, my National Insurance Number has been suspended multiple times, and my broadband will be cut off imminently. Wouldn't be nice to screen out all the fraudsters?

So I've set up a Bananaphone. When people ring me, they get 30 seconds of my favourite song. Then the call is passed to me. The theory being that my friends get to enjoy a short ditty but con artists are likely to hang up before the call connects to me.

As detailed in last year's blog, I've set my Android phone up to make and receive SIP calls. I use the SipGate service which, as well as being cheap, has a nifty API.

It's a pretty simple service to set up. Once you've signed up and activated the developer package, set up a webhook:

Give it a URL which spits out this bit of XML:



   
      https://example.com/banana.wav

There are a bunch of examples in a variety of language.

The WAV file has some specific format requirements. Specifically, it needs to be an 8kHz 16bit PCM WAV file.

And... that's it! It's a bit early to say whether it has eliminated spammers (or turned off legitimate callers). I might go a bit further and change this to a recording which says "This call is protected by spam guard. Press 1 to be connected." But this is a quick, easy, and fun solution.

Why do scammers love NameCheap?

@edent — Wed, 19 May 2021 11:33:19 +0000

The UK is facing an epidemic of SMS fraud. Scammers know that we're all at home eagerly waiting for deliveries. So they send out phishing messages saying "Sorry we missed you" or "You need to pay a delivery fee". If you click on the link they send, you'll go to a very convincing website which looks identical to the courier's page.

Whereupon the fraudsters will ask for your bank details, credit card number, mother's maiden name, and inside leg measurement.

There are many complex reasons why this fraud proliferates. But one thing underpins these scams - a domain name and hosting. Over the last few months, the vast majority of the fraud I've seen has come from domains registered by NameCheap.

OK, but that's anecdotal evidence. Is there anything more robust?

My friends in the UK's National Cyber Security Centre have released a report looking at phishing - amongst other things. Here's what they have to say about NameCheap:

Figure 1 shows that NameCheap became the most popular host of UK government-themed phishing during 2020.By December 2020 we found that it hosted in excess of 60% of phishing in this category.

NameCheap appear to be the preferred supplier of domains and hosting to the criminal community.

OK, they can't easily control who registers domains. But I'm sure that they take reports of abuse seriously. Right?

Looking specifically at the number of campaigns hosted by NameCheap against its monthly median attack availability, we see that by mid-year the median takedown times were consistently in excess of 60 hours. This undoubtedly made NameCheap an attractive proposition to host phishing and may explain the rise in monthly hosted campaigns that followed for UK government-themed phishing.

Oh...

The problem is, these domains are designed to be "hit-and-run". The spammer sends as many phishing messages as possible, in as short a time as possible. They're expecting the domain to be taken down. Every minute counts.

The CEO of NameCheap is, unsurprisingly, defensive of his company's handling of the situation.

What can be done?

There are some proposals to restrict access to new domains - but I don't think that's effective. A spammer can register a domain, wait a month, then blast it out.

NameCheap could make it harder for people to register domains with them. They accept anonymous registration using crypto-currency. I want to live in a world where people can anonymously register web services - but I also don't want to be bombarded with spam.

Given that NameCheap want anonymous customers, and given the prices for hosting are cheap, perhaps they should be taking "good behaviour" deposits from anonymous customers? Take, say, a hundred pounds and refund it only if the account isn't suspended.

Perhaps Nominet could insist that its members take swifter action against spammers - and then remove the ability to resell domains for those that don't?

Maybe NameCheap should increase its prices so that it can afford to pay for the abuse staff that it so desperately needs?

There are no easy answers here. But NameCheap are obviously doing something to attract - and profit from - scammers. What can be done to make them take more responsibility?

"Looks like I´m single again" Why can't Twitter deal with this spam?

@edent — Fri, 14 May 2021 11:01:24 +0000

Twitter has never really solved its spam problem. It is a constant irritation that ordinary people get booted off the service for minor infractions, while large spam rings go unpunished.

For the past few months, some of my old tweets have been getting liked by random women. I'm sure you've see something similar.

The idea is, I suppose, to arouse your curiosity. "Who is this young woman showering me with attention? I'd better check her profile!"

Gosh! Young, pretty, single, and she's interested in me!!! WOWEE!

Scroll down, and you'll see lots of videos of the woman dancing, posing for the camera, and generally Tweeting plausibly generic statements.

But... I've got a nagging feeling that I've seen this woman - and her bio - before. I've seen it a lot.

By my count, there's at least 60 of these identikit spam accounts. They all have the same bio - with the same idiosyncratic punctuation of "I´m". And they all post identical content. Whether it's "Olivia", "Amelia", or "Lucy" - it appears to be the same set of photos and videos. Possibly stolen from some unwitting person's private account.

The avatar changes, as do the captions on the photos. But it is mostly identical media posted in the same order.

If you scroll back far enough through the (identical) spam content, you can usually find archaeological evidence of the previous user.

They all seem to follow this pattern. Accounts which were last active several years ago, which have been re-purposed into spam. A few are more recently active - this one still has the author's pinned Tweet from a few months ago.

I suspect credential stuffing - or the hack of a once-popular Twitter app.

So, what happens if you're daft enough to follow one of these spam-sirens? You get a DM pretty quickly.

This totally real person is watching TV, just like me! Oh, and she has sent an unsolicited "booty" pic - just like a regular girl! Wow! I'd better follow her on this not-at-all shady site…

It is such boring, obvious spam. It doesn't require some super-advanced AI to detect.

If an account suddenly changes its name and profile image - especially on a dormant account - that should be flagged.

Posting content - in the same order - as other spam accounts? Flagged!

Sending DMs with a link to a spam site? Flagged!

Sure, shutting down these obvious spam accounts may lead spammers and fraudsters to try more complex routes to evade detection. It's all an arms race.

But when Twitter doesn't make the bare minimum effort to protect users, then it begins to smell a bit like negligence.

if ( gender == "female" && married == True && age >=30 ) { hasChildren = True; }

@edent — Wed, 12 May 2021 11:21:11 +0000

Marketing really is crap. Recently, SE Railways sent this piece of email drivel to my wife:

We don't have any kids, thankfully - and are not having any in the future. My wife was literally recovering from a sterilisation procedure when the email arrived. So it seemed a bit weird that they'd send her a message like that.

My wife has never booked a child's fare. She's done nothing to indicate to them that she has spawned. They know that she's married and female, because she set her title to "Mrs". They got her date of birth from the ID checks they carried out - we think.

As far as we can tell, they've unilaterally decided that all married women of a certain age must have kids. Or, perhaps, they just lazily sent the message to all women?

So, she spoke to them, to ask why this specific piece of guff had been sent to her. All they'd say was the rather nebulous statement that the emails was a "targeted email sent to a number of passengers [...] When passengers use our services we're able to use this data to help us target communications effectively."

Not really answering the question. But they decided to bung us £20 of M&S vouchers for the "upset".

Even the most modest of interactions with a company will be data-mined for trivial details in the vague hope of getting you to spend more money.

Here are a few tips if you want to avoid getting microtargetted like this:

Consider using a gender neutral title like Mx - or earn yourself a doctorate.
Use an initial rather than a first name. Names can be used to determine likely age.
Don't answer any demographic questions which aren't necessary to the provision of the service, or have a legal/regulatory basis.
You generally can't unsubscribe from service emails, but you can close your account once you've finished your transaction. Digital hygiene is essential!

Of course, if you complain about a mistargeted email, that's another data-point they have about you!

"Advanced Network Error Search" - how to turn off Virgin's least helpful service

@edent — Tue, 02 Mar 2021 12:30:58 +0000

tl;dr you have to keep complaining to Virgin for several months and then take them to the Communication & Internet Services Adjudication Scheme then complain to their Data Protection team by contacting them on LinkedIn.

Background

Virgin have a spammy DNS hijacking service. If you accidentally misspell a domain - for example example.coom - Virgin will pretend that the domain exists and serve you up an advertising page.

Yahoo powered! Yeuch! This means my data is sent to these advertisers without consent.

For the technically minded, the Virgin Media DNS should return NXDOMAIN instead it fraudulently returns NOERROR and redirects the user to the spam site.

Don't worry, there's a link to switch off the service.

But it is broken. It always says "the advanced network error search is already switched off."

Lots of people report having this problem but Virgin don't have an official fix for it. It is possible to change your devices' DNS servers - but it is impossible to change the DNS on the SuperHub. But, frankly, you shouldn't have to. Virgin should provide a proper DNS service.

So, here's how I got them to fix it. I hope this works for you too.

Raise a complaint

I raised an issue in the community forums. That's generally the best way to get in touch with the UK-based support team.

Eventually someone contacted me there and I was able to explain the issue. They started raising it with their IT team. But were unable to fix it.

I also raised a complaint directly with Virgin's complaints team.

After two months of being ignored, lied to, and misdirected - I asked for a Deadlock Letter. That allows you to make a complaint to the dispute resolution service.

Sadly, Virgin refused to issue a Deadlock. But as it had been longer than eight weeks, I was able to complain directly vis https://www.cedr.com/consumer/cisas/.

A couple of weeks later, I got a notification that my complaint had been accepted by CISAS. By complete coincidence I received a phone call from Virgin the exact same day offering me a solution!

Apparently the only way to change this setting was for Virgin to delete my customer account and rebuild it from scratch. Yup, their solution was to literally turn my account off then on again. Their only other option was to release me from my contract without penalty. As they're the only fibre provider near me, I let them switch me off for a couple of hours.

It didn't work.

The Data Protection Angle

I reckoned that if Virgin were sending my browsing data to a 3rd party without my consent, that was a GDPR issue. So I emailed Virgin's Data Protection team saying:

Virgin Media have forcibly enrolled my account into their "Advanced Network Error Search" service.

When I mistype a domain name, Virgin redirects me to an advertising service powered by Yahoo.

I would like to understand on what legal basis are you sharing my data with Yahoo and the advertising partners on the service. I see no mention of it in https://www.virginmedia.com/shop/the-legal-stuff/privacy-policy

As per your policy, I wish to assert the following rights:

The right to restrict processing

I have repeatedly asked your technical team to remove me from the Advanced Network Error Search service. They have refused. I am therefore instructing you to restrict the processing of my data for the purposes of this service.

Please let me know your response by 1st March.

I didn't hear back.

So I found their Head of Data Protection on LinkedIn and politely asked him to take a look into it for me. He told me to email a generic address. I explained that I had already done so but received no reply, so he gave me his direct address. I forwarded him the above, and got a swift reply saying they'd look into it.

A week later, I got a weird email saying my Web Safe Parental Controls had been changed.

I hadn't changed them. But, obviously someone at Virgin had monkeyed around with my account - because the accursed Advanced Network Error Search had gone!!

They phoned me shortly afterwards and confirmed that the issue had finally been resolved.

And all it took was three-months of complaining...

Compensation

Virgin offered a one month bill refund - £48 - by way of an apology.

In light of the months of arguing back-and-forth and the amount of time I wasted trying to get this fixed, I asked for £300 of compensation. Which they paid. (!!!!!!)

They separately also gave me bill credit for the delay in processing the case.

What Have We Learned?

Virgin media have shitty customer service. Their backend systems are antiquated and unreliable. But they have fastest speeds in my area and low(ish) prices, so I'm stuck with them.

But, more importantly, the threat of GDPR is an excellent way to force companies to behave!

Join Virgin Media and get £50 bill credit

If you fancy putting up with this sort of nonsense, join Virgin Media and we both get £50.

Scammers registering date-based domain names

@edent — Fri, 03 Jan 2020 12:54:54 +0000

Yesterday, January 2nd, my wife received a billing alert from her phone provider.

Luckily, she's not with EE - because it's a pretty convincing text. That domain name is specifically designed to include the day's date.

If you're stood up on a crowded train, with your phone screen cracked, would you notice that a . is where a / should be? A quick look at the URl shows a trusted domain at the start - followed by today's date.

It starts with https:// - that means it's secure, right? Is .info even recognisable as Top Level Domain?

Scammers know these domains get blocked pretty quickly - so there's no point registering a generic name like billing-pdf.biz only to have it burned within a day. By the time I'd fired up a VM to inspect it, major browsers were already blocking the site as suspicious.

Is there any way to stop this? No, not really. Domain names are cheap - you can buy a new .info for a couple of quid. The https:// certificate was freely provided by Let's Encrypt. The site was probably hosted somewhere cheap, and whose support staff are asleep when abuse reports come in from the UK.

And that's the price we pay for anyone being able to buy their own domain and run their own secure site.

Money and technical expertise used to be strong barriers to prevent people from registering scam domains. But those days are long gone. There are no technical gatekeepers to keep us safe. We have to rely on our own wits.

Warning - do not click on Twitter ads

@edent — Sun, 26 May 2019 11:37:54 +0000

It seems that Twitter has lost control of its advertising system. This blog post will show you why it is dangerous to click on any Twitter advertising.

Twitter ads have always been a bit crap, but I've seen a recent influx in outright scams. Let me step you through a couple of examples.

A typical click-bait headline. What has our favourite celeb done this time?

In a moment of weakness, let's click through...

Straight away we can see that the branding on the site has been set up to mirror a popular news website.

The "article" is a poorly disguised get-rich-quick scheme. Spoiler Alert! You will not get rich quick - you will get poor rapidly.

This is the sort of advert which shouldn't get through a manual review. I'd argue that even automated tooling should be able to spot spam, scams, and frauds like this. But Twitter is completely asleep at the wheel here.

How do I know? Let's look at who promoted the ad. Usually these scams are pushed by dormant account, or by freshly created accounts. In this case, it is promoted by an ordinary user. And, it appears that they are entirely blameless - this advert did not originate with them.

The user claims they didn't post this. Someone has hijacked their account - probably by weak password reuse - and started spewing spam.

Why don't people spot this?

Twitter promoted posts don't have to show up on your timeline. Apple, for example, sends out lots of adverts like this:

But if you take a look at twitter.com/apple - it looks like they haven't ever tweeted!

If your account has been hijacked by a spammer, you won't know about it.

No tweet will show up on your timeline, and your followers won't be able to alert you. You cannot search for posts which have been promoted by you. The only way you'll find out if your account has been compromised is if people start replying to the advert.

As far as I can tell, a regular user can't delete a promoted Tweet from within Twitter. They have to use the Twitter Ad Platform. There is no way a normal user would know to do that.

It goes on

If you click the replies on promoted tweets, you'll regularly see similar comments. Users claiming to have been hacked, and being unable to remove the offending tweet.

Twitter has a problem with deceptive adverts - as I wrote earlier this year "Crypto Scammers Abusing Twitter Cards via Redirects".

You may think a promoted post is going to a site like CNN - but it could redirect you to a malicious site. For example, this promoted Tweet features Elon Musk and looks like it goes to CNN.com

If you're daft enough to click on it, you go to this page. A reasonably convincing clone of CNN. Full of stuff about how you can't lose money. Even has fake comments at the end, to give it legitimacy. But, you'll notice, it isn't a CNN domain. What's going on?

Twitter generates preview "cards" for web addresses. In this case, we can use the Twitter Card Validator to see that the website sends Twitter to CNN - but the user is redirected elsewhere.

In short - Twitter's advertising system is designed in such a way as to mislead the user about where their click will take them.

What can Twitter do to fix this?

Twitter could manually review adverts. Or make sure that the person promoting the tweet owns the domain they're linking to. Or require 2FA before allowing users to buy adverts. Or they could notify users that their account is being used for advertising. Or any one of a dozen ideas I'm sure the gang at Twitter could come up with during a lunch break.

Or they could respond to users who ask them for help.

There are so many blatantly deceptive adverts on Twitter, that I can only conclude that generating revenue is more important than protecting their users. That's an unsustainable situation.

What can you do to stay safe?

When you click on a promoted Tweet, you have no way of knowing whether it was willingly sent by the user. You have no way of knowing where on the web that link will take you.

I urge you not to click on any Twitter adverts.

Crypto Scammers Abusing Twitter Cards via Redirects

@edent — Mon, 04 Mar 2019 12:30:34 +0000

Twitter has a problem with scam advertising. Rather than having humans manually check adverts for acceptability and authenticity, they let almost anyone promote anything.

Whatever meagre protections they build in are rapidly evaded by the scammers. Let's take a look at an example of a promoted crypto-scam about Singapore. I'd say it was obviously a fake, but Twitter says this story comes from CNBC...!

Take a look at the bottom of the image - the CNBC domain name is there...

Diving into the source code of the ad, we can see that the link does not go to CNBC.

In fact, it goes to a crappy WordPress rip-off site on a completely different domain.

What's going on?

Twitter has a product called Twitter Cards which lets developers embed data on their page. These data are used to display large images, videos, and other stuff on the Twitter site.

What's curious is that there are no meta-tags on that spam site to populate the Twitter Card. So why does Twitter think the page is CNBC?

Using Twitter's Card Validator on that spam URl gives us this response:

When the spam site sees the Twitter Card Generator requesting the page, they redirect it to CNBC. Regular users are not redirected.

The Tweet was sent through the Twitter Ads Composer. Which, I guess, lets advertisers pick the image that they want to go with a link.

This is an obviously exploitable hole through which to spew disinformation.

Could this have been prevented?

The account "edayisagift" last Tweeted in 2017. It has a low follower count. I suspect it has been hijacked by spammers.

Should accounts like this be allowed to promote posts on Twitter? Is there a minimum quality threshold that should be met? Are there any ways to check adverts?

Even an automated check on common scam words, and recently reactivated accounts would help to prevent this sort of rubbish.

Perhaps they want to rely on crowdsourcing reports of bad behaviour?

The problem is, this spammy account has already been reported by reputable users - and nothing has been done about it!

Of course, crowdsourcing can also be gamed and manipulated. But this seems like such an obvious scam that I don't understand how it has been allowed to stand.

Recap

Spammers are abusing Twitter cards to lend legitimacy to fraudulent adverts.
Users report these scams.
Nothing happens.
Trust in the platform falls.

It is still going...

Hundreds of thousands of spam listings on Google "My Maps"

@edent — Mon, 16 Apr 2018 11:03:18 +0000

Blogging - because Google don't offer a bug bounty for spam reports...

Back in 2007, Google introduced "My Maps":

Easily create custom maps with the places that matter to you. Allow friends to see and edit your maps, or publish them to the whole world.

Like most Google products, it was effectively abandoned after launch - receiving a superficial update in 2014. Now it is a haven for spammers and fraudsters.

Even Google's mighty AI is unable to detect this complex spam...

How big a problem is this? Pretty big.

Each of those "My Maps" contains a link to a dodgy site delivering dubious downloads. There is, of course, no "report spam" button on these maps. Even if there were, I'm not sure I could be bothered to do Google's job for them.

Naturally, people have reported this spam to Google many times before, but Google show no signs of removing it.

Don't worry, it gets worse! If someone shares a spam map with you - there's no way to remove it from your account!

I've no way to report this to Google, so if you do - please let them know.

Stop! You're talking to fake customer services on Twitter!

@edent — Thu, 30 Mar 2017 06:13:37 +0000

Ever had a moan at your bank on Twitter? You're not alone - it's one of the most popular ways to interact with large companies. But how can you be sure that you're actually talking to the real customer services team?

There's been a worrying rise in the number of fake accounts which attempt to trick people into handing over their banking details. Let's take a look at one of them.

Here we see what looks like a genuine account from one of the UK's biggest banks - NatWest. This account belongs to a phisher - someone who wants to grab your banking details. In this example, the fake account is searching for people complaining to their bank - it replies and asks them to click onto a phony website.

Here, the user has been chatting with the real customer service team - as noted by the blue verified tick. The fake account continues the conversation!

How sure are you that you wouldn't fall for this?

I was able to see most of the replies to this account before it was shut down. Some people were easily mislead.

That's worrying. But it gets worse.

Suppose you were fooled and clicked on the link. You'll be taken to a realistic looking website which asks for all your details.

This looks identical to the real NatWest site. You've probably not noticed that this isn't the real NatWest domain, and that it isn't on HTTPS. Your mobile browser probably hasn't warned you that this is a scam - so you enter your real number.

That's where things get dark quickly.

Dark Phishing Patterns

Everyone knows that you shouldn't give away your full PIN. So the website only asks for the 1st, 2nd, and 4th digit. As soon as I hit submit, it gave me an error. Can you see what it has done?

Now it is asking for the 1st, 3rd, and 4th digits! They now have your customer number, full PIN, and password.

Now they want more.

I'm just surprised that they didn't ask for my mother's maiden name and my first school!

With the above information, the criminals have everything they need to phone up your bank and impersonate you. Or to ring you up and impersonate your bank.

This sort of attack on customers isn't new - but as more people get online, there will be more criminals waiting to defraud the unwary.