You know it is a scam. Most people just mark as spam and move on with their day. But a significant number of people don't. They hastily visit the site, tap in their credit card details, give it their mother's maiden name, confirm address, upload a nude selfie, and only then realise that they've been had.

The Internet works at pretty close to the speed of light. You can register a .uk domain and a minute later it's accessible from the other side of the planet. Brilliant for users who want to quickly launch a website. Also brilliant for abusers who want to launch a spam campaign.

By the time enough people have reported the scammers' domain as suspicious, it is too late. In the time it takes for a registrar to disable the domain, or for its name to make its way to the Safe Browsing List, a million messages have already been sent and enough people have handed over their details.

We're told that "the purpose of a system is what it does". At the moment, the Domain Name System's purpose seems to be a vector for criminals to run scams on people at a terrifyingly high rate.

How big is this problem?

BIG!

There's a great blog post by Andrew Campling which reports on this startling claim:

The study found that at least 10% of all new gTLD domain names registered during the year had subsequently appeared on security blocklists by the time of analysis. It estimated that, taking account of subsequent blocklisting and associated domains not themselves blocklisted, the share of names registered by malicious actors may be closer to 20%.

DNS Abuse and Criminal Infrastructure: Beyond Definitions and Blocklists (emphasis added)

That links to a presentation by Interisle which contains some rather shocking statistics (albeit with disputed methodology). It looks at generic Top Level Domains (gTLD) - those are things like .com and .fun rather than country code TLDs (ccTLD) like .uk and .de.

It says 85 million new registrations of gTLDs were made in 2025. Of those 8.5 million were added to blocklists by May 2025. It reckons that a 10% abuse rate is the likely floor for these numbers and it's probably closer to 20%. One in five newly registered domains with a gTLD are scams. That's a bloody crisis.

13 TLDs had more than 50% of their registrations blocklisted.

I can understand why .bid and .loan are popular with scammers. But why .mobi?! What did I ever do to you, eh?

Who are the scammers registering these through?

Ah, our old friends at NameCheap. See Why do scammers love NameCheap?

If those five registrars had more effective policies, it might significantly dent the scammers' ability to ply their devious wares. Or they might just move on to other registrars.

As the report points out:

suspension rates for blocklisted domains were 7.4% to 16.3%.

The full report is on the Interisle website.

What can be done?

I don't know.

In the first instance, it might make sense for registrars to do strong Know Your Customer (KYC) checks on anyone buying a domain. But that stops anyone who wants to anonymously register I-Hate-Nintendo.whatever without risking the wrath of Intellectual Property lawyers.

Also, criminals have access to stolen money and stolen cards. They can convince a hapless mule to register a domain on the criminals' behalf.

Registrars could ask for an escrow payment. Pay €9 for the domain name put €900 in escrow. If your domain appears on a blocklist within the year, you forfeit the money. Criminals with stolen funds are unlikely to care but it would probably put off lots of people from getting a new domain.

There are various banned words and phrases depending on the TLD. For example, South Sudan has a list of political words which they don't want associated with their .ss ccTLD.

But if one gTLD bans a word, a different one might not. A scammer doesn't care if the gTLD is .arse or .elbow - they just want the start of the domain to look legitimate.

Some registrars have strings that they don't allow. In fairness to NameCheap, when I tried to register dwp-payments-gov-uk.pizza it told me that domain was banned. It wouldn't let me get any gTLD with that name.

But all it takes is one registrar to be slightly lax and the scammers get through. Increasing the complexity of the rules is also a hell of a burden on smaller registrars.

Besides, it's pretty easy to get a generic enough looking domain and stick the confusing bit on a subdomain. Here are a clutch mentioned in the report:

• https://gov.uk-dwpaph.bond/uk/
• https://gov.uk-dwpcjh.bond/uk/
• https://gov.uk-dwpclc.bond/uk
• https://gov.uk-dwpclw.bond/uk
• https://gov.uk-dwpclj.bond/uk/

Perhaps there ought to be a delay before a new domain goes live to allow people to object to it? That would give governments, banks, delivery companies, and a dozen more "important" organisations a right to veto any "dodgy" looking domain.

But suppose someone wants to register gov-uk-stole-my-horse.horse to protest the government's cruel policy of stealing horses - is that a legitimate use of a domain? What if the Darwin Pensioner Divas - a group of elderly singers - want to take payments for their new album of goth/punk covers, can the DPD delivery company veto dpd-payments.music?

Do we want a domain name system where powerful companies control exactly which domains we can register? If I have an idea for a domain on a Friday night do I have to wait until Monday before it can be launched? Are those companies realistically able to parse millions of domains per year and have a low false-positive rate?

All of these things are possible - but all of them come with an impact on legitimate users. To be clear, I don't know what the right answer is.

What is ICANN doing about it?

Lots! It has been a few years since I've been to an ICANN meeting, but even back then the topic of abuse was high on the agenda. They appear to be looking at ways to coordinate abuse reports between various entities, along with some other policies which should hopefully work.

There are two salient points from one of the discussions held at the recent meeting

If anybody thinks that in our current age of AI and as we move into different kinds of computing, DNS abuse is going to numerically stay steady and we will have a downward effect on that baseline 2027 number. I'm not sure that that's an accurate assumption. I think it's going to be the other thing, which is […] it's going to be easier to abuse the DNS.

And

Abusers are going to abuse because it's just too lucrative, because no matter what we do, they will find the way to make profit off of that, and will try to circumvent everything that we do. That is not a reason not to do it, though.

Quite!

As I said, I don't know the answer to this. What I do know is, much like Android's app ecosystem being a haven for scammers, DNS is facing a crisis. When trust in a system goes, only chaos follows.

I don't want to live in a world where I have to show my passport and pay thousands of pounds to register a domain which is only available after being vetted by private interests. But I also don't want to live in a world where scammers have effectively no deterrent from abusing millions of people.

The purpose of a system is what it does. I hope DNS's purpose can become less dangerous while still remaining open.

Nevertheless, some get through. Here's a particularly pernicious one - it appeared as three comments ostensibly in reply to each other.

At first glance these look like normal comments. They each address the content of the blog post albeit somewhat superficially. The first comment looks like it was from a social media post sharing my link - I get a lot of those as pingbacks, so it initially didn't trigger any suspicions from me.

The second is ostensibly a reply to the first and continues the conversation. Again, a bit shallow, but seems to be engaging in good faith.

The third looks like yet another reply. They all have unique email addresses, none of them have set their username to anything overly odd, and none of the users have filled out their URl.

But notice, in the second one, there's a link to a dodgy casino! There's no https:// so it didn't jump out as a link.

All three came from the same IP address in the Philippines, so easy to block for now.

Each reply is spaced exactly 3 minutes apart which, in retrospect, looks a little odd.

Re-reading them carefully, they all look like AI slop. A plausible sounding summary, written in a casual style, but with very little semantic content. Seeing them as replies to each other primed me to think they were genuine because I'm used to spam coming in individual replies. Having the spam in the middle comment made it easy to glaze over.

Remember, there are no technological solutions to social problems. Sticking more and more barriers in the way of commenting only discourages genuine replies while the profit motive incentivises spammers to work around them.

😱 I Can't Use On This Day 😭

Seriously, What’s Going On?! 🔍
I’ve been trying to use the On This Day feature, but it’s just not working for me! 😩
Every time I input my details, it says I have no posts for today, even though I know I’ve posted stuff! 🧐

Here’s My Setup: ⚙️

• Python 3.x 🐍
• Access token fully generated (I triple-checked!) 🔑
• Attempted on multiple instances but still nothing! 😩😩

Could It Be a Bug? 🤔

I’m really starting to doubt my posting history! 😳
Is it supposed to show only specific types of posts?
I’ve made some pretty epic posts before! 💥💬

Documentation Confusion 📚

The README says to register for an access token but doesn’t clarify if it factors into this feature! 🤔❓
Did I miss something REALLY important?!
Help me figure this out, please!!! 😱

Feature Suggestion 💭

If this is broken, can we at least have a debug mode to log what’s happening! 😬
I need to know if it’s truly my fault or the code’s! 🔍🛠
Thanks for looking into this TRAGIC situation!!! 😭💔

P.S. My friends ARE posting on this day and their instances work!! 😤
I feel so left out!! 😟

Let’s get this sorted ASAP! ⚡

OK, that's a lot of Emoji - too much even for me! But if one of my users needs help, I'm there for them! As the feature works for me, I decided I'd ask for the output of the app. Maybe there'd be a clue in the minimal debugging output it had.

I clicked on the link to the Codeberg repository and was hit be a 404! What? I clicked on the link to the user "simpleseaport2" but that was also broken.

"Seriously, What’s Going On?! 🔍"

It looks like Codeberg has been hit by a wave of spam bug reports. I read through the bug report again, slightly more awake, and saw just how content free it was. Yes, it is superficially well structured, the Emoji are a bit over-the-top but not the worst I've seen, and the emotional manipulation is quite insidious.

A few weeks later, I got a bug report to a different repo. This one was also deleted before I could reply to it, see if you can spot that it is AI generated:

I've been trying to use the Threads tool to visualize some conversations but I'm running into a serious problem, and it's really frustrating!

When I input the URL for a post with a substantial number of replies, the script seems to hang indefinitely. I've waited more than 15 minutes on a couple of occasions, and nothing seems to happen. This is not what I expected, especially since the README mentions large conversations may take a long time, but doesn’t specify any limits or give guidance on what users should do if it doesn’t respond at all!

It's unclear what's actually happening here. Is the script failing silently? Is it the API timing out? Why isn’t there any sort of progress notification built into the tool? It feels like a complete dead end.

Can you please add some kind of error handling or logging feature to the Threads script? It would be helpful if it could at least inform the user when a timeout occurs or if the API response is simply taking too long. Additionally, could you clarify the maximum number of replies that can be handled? It’s really inconvenient to have no idea if the script is still processing or if it’s just broken.

Thanks for addressing this. I hope to see improvements soon.

• The emotional manipulation starts in the first line - telling me how frustrated the user is.
• It turns the blame on me for providing poor guidance.
• Then the criticism of the tool.
• Next, a request that I do work.
• Finally some more emotional baggage for me to carry.

I'm not alone in getting these - other people have also received similar spam

To be fair to Codeberg, they are under attack and are trying to stop these specious complaints reaching maintainers.

Post by @Codeberg@social.anoxinon.de

View on Mastodon

But, still, search the socials and you'll find a stream of frustrated developers.

Woke this morning to my first ever AI generated spam issue on a repo. Got it via email. When I went to check it out at Codeberg, it had already been moderated. Wonder how many others were affected. I immediately knew it was AI spam due to the overuse of emojis…🎉

[image or embed]

— Jeff Sikes (@bsky.box464.social) 24 April 2025 at 15:07

What's Going On⁉️

I can only think of a few possibilities - none of them particularly positive.

• Attacking the viability of CodeBerg - make users abandon it for a different platform.
• Attacking the attention of developers - make them unwilling to give attention where it is actually needed.
• Attacking the integrity of users - make them less likely to receive help because they are mistaken for AI.
• Maybe it is just a bored kid or an unethical researcher. Trying to find the limits of what a maintainer will recognise as spam?

Either way, AI bug reports like this are about as welcome as a haemorrhage in a jacuzzi.

Some of the voices are reasonable facsimiles of human voices (like the above) and some are just garbage.

The voice clip plays and the call immediately terminates.

What I can't understand is how this can possibly be effective from the scammers' point of view. On receiving the call the victim must…

1. Decided to answer from an unknown number.
2. Listen to the message and decide it is legitimate.
3. Go the their phone's dialler app.
4. Copy the caller's phone number.
5. Open WhatsApp.
   • Install WhatsApp if they don't have it already
6. Create a new contact - giving a name - and pasting the number.
7. Engage with the contact.

That's a lot of effort based on… what? A vague offer? There's a little bit of a curiosity gap but not much. It's hardly "add me on WhatsApp or we'll release the photos we have of you" or "you've won the lottery, add me on WhatsApp to get the funds", or "This is the CEO of your company, urgently add me…".

I guess that if a spammer is able to send out thousands of these messages then they might be able to attract a couple of people to engage with them. There's no easy way to report a spam account to WhatsApp unless you've engaged with it.

I also assume that WhatsApp will see that you were the person who initiated WhatsApp contact - which makes them less likely to think the scammer is the problem.

I am just fascinated to see if this scam can possibly be effective. Generating fake voices is free, as is placing short calls. WhatsApp accounts are also free and easy to automate. But are there really that many people willing to go to the effort of adding a new contact based on so little information?

Obviously, all spam is a numbers game. If the message reaches someone receptive to a robocall, they're less likely to query the scam. And, yes, I know that you're a very clever boy and don't answer unknown numbers - but in the real world people get calls from hospitals, recruiters, and friends with new numbers.

If you're a spammer and have found this approach effective - please leave a comment!

Update! July 2025. A new variant. Same basic message, but a much more natural sounding voice. I wonder if they're using real people now?

So, because I take every minor complaint as a personal rebuke, I decided to switch to AntiSpam Bee - an open source and local antispam solution.

And... it's pretty good! There is the occasional false negative - but not significantly worse than JetPack.

Most of the false negatives are from non-English language comments:

There are settings so that you can reject comments which aren't in your native language. But that comes with privacy implications.

I didn't spot any false positives - but I get hundreds of spam comments per day.

It's a little more fiddly than Akismet. But, as a power user, I appreciate that. It's also less reliant on a centralised service - who knows what weird AI grab Akismet will do with all the comments it moderates?

You can grab the source code from GitHub

I like the Internet.

What if I could get beer using the Internet?!?!

A few years ago I purchased a mixed crate of beer online. I unticked all the checkboxes for marketing messages - but incautiously allowed them to send me special offers.

Every couple of months, they'd send me an email offering discount beer. And I'd ignore it. Mostly because I was still slowly working my way through the last crate.

But one day their marketing algorithm obviously decided that I was about to become a lost prospect and sent me an irresistible offer. "We miss you! Please enjoy a crate of 36 craft beers for £40."

Nice! I certainly won't look a gift-beer in the bottle. So I grabbed the bargain and stuck the tinnies in the cupboard.

And then the algorithm went haywire.

Every day - every single day - since placing my order, I've received a marketing message from the company. "Don't miss out on this exclusive case!" or "Our top beers - hand picked for you!" or "URGENT! Last few cases remaining at this price!" or "The ULTIMATE taste test - which will you choose?" or "20% discount if you order TODAY" or "Christmas is coming - stock up now!"

I get it. The CRM has detected that I'm a live prospect and willing to spend money - therefore they must capture my value before I churn. I don't know if they know how quickly I can drink 36 beers. I don't know if they know how much shelf space I have. And I don't know if they know that I dislike being bombarded with adverts.

What I do know that they know is the UK rules around advertising of alcohol promotions.

When it comes to consumer promotions with a multiple purchase mechanic promoters need to ensure that the number of items that need to be bought does not encourage consumers to exceed Department of Health guidelines for safe drinking and they should keep up to date with these guidelines. They should also ensure that the duration of the promotion is long enough to allow consumers to participate without drinking excessively or irresponsibly

Interestingly, all the marketing emails came to me in the evening. Presumably because the guidelines also say:

Alcohol promotions that could encourage a style of drinking that is unwise, for example encouraging people to drink at breakfast or early in the day, are likely to be problematic

There's an old complaint about being shown adverts for things you've already purchased. It is mostly down to lazy marketers using retargeting and is usually little more than an annoyance. But continually messaging people encouraging them to buy alcohol feels like it could cause harm.

Alcohol can be addictive. As can A/B testing your customers to see which messaging resonates with the target demographic. Advertisers - know your limits!

I know you might think I'm exaggerating - but here's a fortnight's worth of emails from online beer merchant Flavourly:

I hadn't checked the inbox for a month, hence the build-up of crap before I could unsubscribe.

That's pretty enticing! It's what LinkedIn uses to drive its premium product. Perhaps it would tell me if a potential employer was looking at my profile? Or if my crush kept visiting it!??!?!?

So people visited the website and signed in with their Twitter account. Whereupon the app started posting spam. Something which looked like this:

The Twitter API does not have the functionality to record visitors to a profile. This app is lying to users. But it tells an interesting lie. And that encourages people to click on the spam and log in with their own account.

As soon as I spotted it, I reported it via the Twitter Insiders' programme. And, to their credit, they managed to shut it down pretty quickly.

And then it popped up again.

InfernoTheFox🏳️‍🌈🏳️‍⚧️

@Infernothefox

Don't know how this garbage got onto my account, but I've since changed my password and revoked any apps I don't recognize or haven't used in ages.

Do yourselves a favour, AVOID THIS LIKE THE PLAGUE!!

Terence Eden is on Mastodon

@edent

Warning - new spam app is spreading through Twitter.
Twoo .fun cannot tell you who visits your Twitter profile. It is a scam.
If you sign up, you give it *full* access to your account.
You need to immediately remove it at
x.com/settings/conne… pic.x.com/9OploQ13Oi

---

---

And Again

Ed_biker

@Edpalo

Praga....total..clicou fudeu.

Terence Eden is on Mastodon

@edent

Warning - new spam app is spreading through Twitter.
Twoo .fun cannot tell you who visits your Twitter profile. It is a scam.
If you sign up, you give it *full* access to your account.
You need to immediately remove it at
x.com/settings/conne… pic.x.com/9OploQ13Oi

---

---

And again.

naclara★

@naclaraincrivel

olá pessoas que foram burras igual a mim e caíram no vírus, cliquem no link que esse cara disse e revogue a permissão

Terence Eden is on Mastodon

@edent

Warning - new spam app is spreading through Twitter.
Twoo .fun cannot tell you who visits your Twitter profile. It is a scam.
If you sign up, you give it *full* access to your account.
You need to immediately remove it at
x.com/settings/conne… pic.x.com/9OploQ13Oi

---

---

And again.

Hellscythe 🦁 VTuber | Enjoying Spooktober

@Sir_Hellscythe

Apologies to anyone that has seen this Spam app tweeting without me knowing in the last couple of hours, I was unaware that this was a spam app, I have deleted all the tweets it posted and have revoked/removed access of it from my account, please don't make the same mistake as me

Terence Eden is on Mastodon

@edent

Warning - new spam app is spreading through Twitter.
Twoo .fun cannot tell you who visits your Twitter profile. It is a scam.
If you sign up, you give it *full* access to your account.
You need to immediately remove it at
x.com/settings/conne… pic.x.com/9OploQ13Oi

---

---

It has been grimly fascinating to see how it spreads through different communities and different language groups.

You can watch it spread in realtime using https://twitter.com/search?q=Twoo.fun&src=typed_query&f=live

It has since metastasised into a similar scam called AskForMe.me - again, you can see it worm its way through communities at https://twitter.com/search?q=askforme.me&src=typed_query

In this case, the spam specifically mentions other users and posts fake statistics about how long they've been viewing the profile.

I keep reporting this to Twitter. And they keep shutting it down. And it keeps popping back up!

I don't have access to Twitter's systems - but it seems to me like there are some easy ways to curtail this scam. At the very least blocking those two domains would force the spammers to keep moving to new hosts. Perhaps Twitter could look for new apps which suddenly start posting messages which are quickly marked as spam. Or they could do some fancy machine-learning to identify similarly scammy images.

At the moment, we don't know what the end-game is for this spam. Maybe is it "just" a worm and someone is having a giggle seeing how many people they can infect. Perhaps it is harvesting accounts hoping to sell them to other spammers. Or it could be slurping down the social graph for other nefarious purposes.

Either way, this has been going on for at least five months! I think I've done what I can to inform Twitter. In the meantime, I urge you to warn your followers about this spam.

If you've been infected with this Twitter scam, please visit https://twitter.com/settings/connected_apps to remove it from your account.

Update! Looks like this spam has been doing the rounds since 2018!

Malwarebytes

@Malwarebytes

“Who visits your #Twitter profile” #spam app brings week of chaos | #Malwarebytes Lab blog.malwarebytes.com/cybercrime/201… by @paperghost #cybersecurity #infosec #socialmedia pic.x.com/4XPycLG2VG

---

The notifications come direct to my Android phone via the Drive app - they don't appear in my Gmail spam folder. There is no way to report the abuse.

If I go to the list of notification in the Android apps, there's no option to report that the notification is spam.

If I'm stupid enough to open the spam file, there is a context menu but - again - no way to report spam.

What about the detail pane? That'll have something, surely?

Nope! Nothing.

Let me be me clear, just as Zawinski's law says "Every program attempts to expand until it can read mail" - so every Google app expands to be a vector for spam.

There's also no way to report the spam from the web version of Drive. The notifications simply don't appear there.

In typical Google fashion, there's no support forthcoming for users who are inundated with these messages. So the poor users howl into the void - desperate for Google to respond. But all Google will do is spout platitudes.

Google Drive

@googledrive

@welderswife638 Hi there. Please report the files to remove them and help train our systems (goo.gle/2SwoC6B). We are constantly working to make our detection better and give users more options for managing the spam that sneaks through.

---

Google Drive

@googledrive

@balkissoon Hi, Denise. We know this is a serious issue and we're working to improve our spam detection and prevention.

---

Google Drive

@googledrive

@GamingDaveUK Hi, David. Please report the files to remove them and help train our systems (goo.gle/2SwoC6B). We are constantly working to make our detection better and give users more options for managing the spam that sneaks through.

---

goonicide hotline volunteer

@spicytm

CAN PORN BOTS STOP SENDING ME SHIT ON GOOGLE DRIVE pic.x.com/L6sWr4ybfW

---

Google Drive

@googledrive

@_spicytm Hi there. If you don't want to get file shares from someone in Google Drive, you can block them. If you use Google Drive for work or school, you can’t block someone in your domain. Learn more here: goo.gle/2VnV3rp. Hope this helps!

---

Unicorn Reviews 🦄

@UnicornReviews

Replying to @googledrive@googledrive please fix pic.x.com/ybUV0hSn0h

---

Google Drive

@googledrive

@UnicornReviews Hi there. Please report the files to remove them and help train our systems (goo.gle/2SwoC6B). We are constantly working to make our detection better and give users more options for managing the spam that sneaks through. Hope we helped.

---

Google Drive

@googledrive

@S3V3NNDS1NN Hi there. Please report the files to remove them and help train our systems (goo.gle/2SwoC6B). We are constantly working to make our detection better and give users more options for managing the spam that sneaks through.

---

Google Drive

@googledrive

@jackjt8 Hi again, Jack. Let's connect you with our Support Team for help. Follow the link to get some help: goo.gl/LcAuFy. Keep us posted!

---

MoistDev 🏳️‍⚧️

@Moist_Gameplays

Replying to @googledrive@googledrive can you please implement an option to prevent File sharing from "everyone"? I'm sick of these spam files being shared to me.

I want file sharing from only Friends. Not anyone who managed to get ahold of my Email. pic.x.com/0YvayOEmTo

---

Google Drive

@googledrive

Replying to @Moist_Gameplays@Moist_Gameplays Hi there. You can block users in several different ways. Find out more in our article here: goo.gle/2VnV3rp. I hope this help!

---

Noah

@MightyMack03

This shit is starting to get ridiculous.

Google Drive now???? Really. pic.x.com/zWXJpDTVje

---

Google Drive

@googledrive

@MightyMack03 Hi, Noah. Please report the files to remove them and help train our systems (goo.gle/2SwoC6B). We are constantly working to make our detection better and give users more options for managing the spam that sneaks through.

---

Google Drive

@googledrive

@dweekly Hi, David. Please report the files to remove them and help train our systems (goo.gle/2SwoC6B). We are constantly working to make our detection better and give users more options for managing the spam that sneaks through.

---

Tedious, isn't it?

You will notice that all the links point to sites which don't actually help! When people ask Google how they report spam - Google are utterly silent.

Google Drive

@googledrive

@PopCultured4 Hi there. Please report the files to remove them and help train our systems (goo.gle/2SwoC6B). We are constantly working to make our detection better and give users more options for managing the spam that sneaks through.

---

🍿🦋 PopCultured4 🎮💚

@PopCultured4

@googledrive My question is HOW to do this via Android phone/app?

---

Google Drive

@googledrive

@jhill641 Hi, Joe. Please report the files to remove them and help train our systems (goo.gle/2SwoC6B). We are constantly working to make our detection better and give users more options for managing the spam that sneaks through.

---

Joe Hill

@jhill641

@googledrive In the link I only see a way to report the file on desktop is there no way to report the file on the android app ? I sent feedback to Google but I don't see a way to report the file on mobile pic.x.com/DYT9Rw11Ds

---

Google Drive

@googledrive

@jeffvenuti Hi, Jeff. Please report the files to remove them and help train our systems (goo.gle/2SwoC6B). We are constantly working to make our detection better and give users more options for managing the spam that sneaks through.

---

Jeff Venuti

@jeffvenuti

@googledrive I get the notification on my phone but I don't see them pop up in my Drive. How do I report them from just the notification? Or is there a folder I'm not seeing in my drive with all of them?

---

Google Drive

@googledrive

@sarahradz_ Hi, Sarah. Please report the files to remove them and help train our systems (goo.gle/2SwoC6B). We are constantly working to make our detection better and give users more options for managing the spam that sneaks through.

---

sarah

@sarahradz_

@googledrive I cant report them unless I click on them. I see the notifications but can't see them in my drive

---

I think it is clear that Google have lost control of their platforms. There is no central authority in Google who is in charge of ensuring a consistent and pleasant user experience. Their customer service agents aren't empowered to actually help users - nor can they escalate emergent issues to management.

As an abusive monopoly, there's very little incentive for Google to fix this.

So, like a mug, I'm attempting to catch the passing eye of some Google employee who can raise this internally.

*sigh*

James Whatley (inactive)

@Whatleydude

Surprised Loch Ness isn't trending tbqh.

---

James Whatley (inactive)

@Whatleydude

Searching for Loch Ness on Google Maps is certainly an eye opener if you decide to look around once you get there.

Ahem.

Night night.

---

What could this possibly mean? I searched for Loch Ness on Google Maps.

Oh! Hey! Someone's posted a 360 photosphere from the very centre of the Loch!

Huh... That doesn't look like the beautiful Scottish countryside. I wonder what happens if I pan around...?

🚨 🍆 🚨

(Redacted for his privacy and your comfort.)

It's pretty easy to upload spam to Google Maps. I suspect that whatever BIG DATA ARTIFICIAL INTELLIGENCE ALGORITHMS they have simply don't work on panoramic photos.

Anyway, I reported it - yay for doing unpaid labour for a megacorporation - and it has vanished.

The thing is, this isn't a mistake or a glitch. There's a user who literally enjoys repeatedly posting these photos to scenic locations.

I know the "wisdom of the crowds" means that large companies don't have to worry about bad actors⸮ But perhaps Google could spend a little of its time and money moderating the content it displays. If one determined user is able to gain this many views - what could a more malicious user accomplish?

Be seeing you!

Let's take a look at all the ways we can tell it is a scam.

Firstly, and most obviously, I am not a customer of Lloyds Bank! But these scammers send out to multiple people hoping to catch victims.

Secondly, I've not made a complaint to Lloyds! But, again, scammers know that plenty of people have. So this adds a touch of authenticity. If you were a Lloyds customer who had recently complained - you're now primed to accept the scammer's call and treat it as legitimate.

Thirdly, that phone number. If you call it, a recorded voice says "Welcome to customer services..." Whose customer services? It doesn't say "Welcome to Lloyds". This is likely a number that scammers put on texts claiming to be from HSBC, Lloyds, NatWest. Cheaper for them to have a single phone number.

Fourthly, the reference number. It is just my phone number! That's an unusual reference number for a bank.

There's some weird spacing between "Mr" and "Eden" - not what I'd expect from a professional message.

What do you think of the SMS? Would you flag it as spam? I asked my Twitter followers and their responses were unanimous.

Terence Eden is on Mastodon

@edent

I received this unsolicited SMS earlier today.
I don't bank with Lloyds.
What do you think of it? (Poll in next tweet.) pic.x.com/yh4OrBwfM6

---

Terence Eden is on Mastodon

@edent

Do you think that SMS from Lloyds is…
📊

---

⚠ Definitely a scam: (195)
195
😕 Probably a scam: (126)
126
🤔 Probably legitimate: (34)
34
😇 Absolutely fine: (13)
13

---

A few minutes after receiving the SMS, I got a call from a Peterborough number - not the 0800 number. The phone number was flagged as suspicious (read the number's reviews).

After the customary pleasantries, the voice at the end of the phone said "Can you just confirm your name and address for me please?"

I replied that I didn't give that information out to cold callers.

"Completely understandable sir. If you check your messages, you'll see an SMS from us scheduling the call. Did you receive that?"

I replied that I get lots of spam texts and that I couldn't be sure it was legitimate.

We reached an impasse.

With a little subtle social engineering on my part, I found out the nature of the complaint. And then I realised... it was a legitimate call!

A few months ago, I'd complained to Halifax Bank that they were sending letters to someone who didn't live at my address.

The 0800 phone number is owned by Halifax

Lorraine Underwood

@LMcUnderwood

@edent Did Halifax bank turn into Lloyds… ??
Tweet from 2015 mentions that number

---

Halifax are part of Lloyds Bankings Group.

The geographic number I received a call from is the Lloyds outbound number.

In my defence - this did have most of the Hallmarks of a scam! Lloyds have tried to do the right thing by alerting me that the call is coming. They've provided a trusted phone number for me to call if I am concerned. They've given me the name of the caller, and a reference number.

But these are all things a scammer can do as well!

Lloyds could have made this better. Does the average user know that Halifax is part of Lloyds? I didn't. Why didn't the call come from the number that they'd sent in their text? Would a link to a simple URl like lloyds.com/contact have reassured me? How about lloyds.com/complaint/ref/123...?

Instead, several silly mistakes and my unhealthy paranoia collided and convinced me it was a scam.

What's the solution here? Sure, Lloyds can up their game - but a canny scammer can just tweak the wording and send out a convincing forgery. We can all abandon SMS and move to some cryptographically signed service which no one can use properly. We can hope that mobile networks crack down on SMS spam and only let legitimate messages through. Or users can dial down their paranoia - and hope for the best.

But, sadly, it seems that trusting messages from financial services are all but impossible right now.

If my number is 07700 900 123 I get calls from 07700 900 124 or 07700 900 456

Here's my working theory on why spammers do this. Americans.

In the UK, there's a separate "area code" for mobile phones. If a number starts 07 then it is mobile (it's a bit more complicated than that).

In the USA, there's no cellular prefix. If you buy a SIM card in Las Vegas, you'll probably get a 702 number - at least, I did when I last visited.

Some of the area codes in the USA cover tiny geographic areas.

Spammers know this. They bet that if they call +1-555-867-5309 from +1-555-867-5409 the person will believe the spammer is local to them. Possibly even a neighbour. It is a weak form of social engineering attack. You're more likely to trust someone local than a distant stranger.

In the UK this doesn't work. Not because we don't trust our neighbours, but because our mobile numbers aren't tied to a specific geography.

Cultural hegemony can be an effective anti-shibboleth!

This was created with Amazon Polly which is free for casual use. I was pretty impressed with the voice quality. Although there are limits to how well you can control the speed and intonation.

While there are a number of accents available, there are only a small number of distinct voices in British English.

Type your text, choose your voice, listen in the browser, then download the audio.

So I've set up a Bananaphone. When people ring me, they get 30 seconds of my favourite song. Then the call is passed to me. The theory being that my friends get to enjoy a short ditty but con artists are likely to hang up before the call connects to me.

As detailed in last year's blog, I've set my Android phone up to make and receive SIP calls. I use the SipGate service which, as well as being cheap, has a nifty API.

It's a pretty simple service to set up. Once you've signed up and activated the developer package, set up a webhook:

Give it a URL which spits out this bit of XML:

<?xml version="1.0" encoding="UTF-8"?>
<Response>
   <Play>
      <Url>https://example.com/banana.wav</Url>
   </Play>
</Response>

There are a bunch of examples in a variety of language.

The WAV file has some specific format requirements. Specifically, it needs to be an 8kHz 16bit PCM WAV file.

And... that's it! It's a bit early to say whether it has eliminated spammers (or turned off legitimate callers). I might go a bit further and change this to a recording which says "This call is protected by spam guard. Press 1 to be connected." But this is a quick, easy, and fun solution.

Whereupon the fraudsters will ask for your bank details, credit card number, mother's maiden name, and inside leg measurement.

There are many complex reasons why this fraud proliferates. But one thing underpins these scams - a domain name and hosting. Over the last few months, the vast majority of the fraud I've seen has come from domains registered by NameCheap.

OK, but that's anecdotal evidence. Is there anything more robust?

My friends in the UK's National Cyber Security Centre have released a report looking at phishing - amongst other things. Here's what they have to say about NameCheap:

Figure 1 shows that NameCheap became the most popular host of UK government-themed phishing during 2020.By December 2020 we found that it hosted in excess of 60% of phishing in this category.

NameCheap appear to be the preferred supplier of domains and hosting to the criminal community.

OK, they can't easily control who registers domains. But I'm sure that they take reports of abuse seriously. Right?

Looking specifically at the number of campaigns hosted by NameCheap against its monthly median attack availability, we see that by mid-year the median takedown times were consistently in excess of 60 hours. This undoubtedly made NameCheap an attractive proposition to host phishing and may explain the rise in monthly hosted campaigns that followed for UK government-themed phishing.

Oh...

The problem is, these domains are designed to be "hit-and-run". The spammer sends as many phishing messages as possible, in as short a time as possible. They're expecting the domain to be taken down. Every minute counts.

The CEO of NameCheap is, unsurprisingly, defensive of his company's handling of the situation.

Richard Kirkendall

@NamecheapCEO
Namecheap.com

@CenturyAvocado @carlheaton @alexbloor @cybergibbons @Namecheap For example, there is 1 criminal gang that we've been fighting against targeting UK delivery services and banks. You live in your own bubble and that's all you care about and are exposed to.

---

Ross Henderson-McKillop 

@rsmck

@Namecheap @NamecheapCEO All the information you need is in that tweet. If you need to raise a ticket in Kayako to keep track of it, you can do that yourself using the handy "New Ticket" function and assign it to the relevant department.

Or, you can ignore a fraud report, and be complicit in it.

---

Richard Kirkendall

@NamecheapCEO
Namecheap.com

Replying to @rsmck@rsmck @Namecheap More than 9 out of 10 abuse reports submitted to us are false or incorrect. We processed/investigated 1.1 million abuse claims/reports in 2020 and only 100k of them were actually found to be linked to abuse. Less than 1 percent of domains registered with us. Submit a ticket.

---

What can be done?

There are some proposals to restrict access to new domains - but I don't think that's effective. A spammer can register a domain, wait a month, then blast it out.

NameCheap could make it harder for people to register domains with them. They accept anonymous registration using crypto-currency. I want to live in a world where people can anonymously register web services - but I also don't want to be bombarded with spam.

Given that NameCheap want anonymous customers, and given the prices for hosting are cheap, perhaps they should be taking "good behaviour" deposits from anonymous customers? Take, say, a hundred pounds and refund it only if the account isn't suspended.

Perhaps Nominet could insist that its members take swifter action against spammers - and then remove the ability to resell domains for those that don't?

Maybe NameCheap should increase its prices so that it can afford to pay for the abuse staff that it so desperately needs?

There are no easy answers here. But NameCheap are obviously doing something to attract - and profit from - scammers. What can be done to make them take more responsibility?

For the past few months, some of my old tweets have been getting liked by random women. I'm sure you've see something similar.

The idea is, I suppose, to arouse your curiosity. "Who is this young woman showering me with attention? I'd better check her profile!"

Gosh! Young, pretty, single, and she's interested in me!!! WOWEE!

Scroll down, and you'll see lots of videos of the woman dancing, posing for the camera, and generally Tweeting plausibly generic statements.

But... I've got a nagging feeling that I've seen this woman - and her bio - before. I've seen it a lot.

By my count, there's at least 60 of these identikit spam accounts. They all have the same bio - with the same idiosyncratic punctuation of "I´m". And they all post identical content. Whether it's "Olivia", "Amelia", or "Lucy" - it appears to be the same set of photos and videos. Possibly stolen from some unwitting person's private account.

The avatar changes, as do the captions on the photos. But it is mostly identical media posted in the same order.

If you scroll back far enough through the (identical) spam content, you can usually find archaeological evidence of the previous user.

They all seem to follow this pattern. Accounts which were last active several years ago, which have been re-purposed into spam. A few are more recently active - this one still has the author's pinned Tweet from a few months ago.

I suspect credential stuffing - or the hack of a once-popular Twitter app.

So, what happens if you're daft enough to follow one of these spam-sirens? You get a DM pretty quickly.

This totally real person is watching TV, just like me! Oh, and she has sent an unsolicited "booty" pic - just like a regular girl! Wow! I'd better follow her on this not-at-all shady site…

It is such boring, obvious spam. It doesn't require some super-advanced AI to detect.

If an account suddenly changes its name and profile image - especially on a dormant account - that should be flagged.

Posting content - in the same order - as other spam accounts? Flagged!

Sending DMs with a link to a spam site? Flagged!

Sure, shutting down these obvious spam accounts may lead spammers and fraudsters to try more complex routes to evade detection. It's all an arms race.

But when Twitter doesn't make the bare minimum effort to protect users, then it begins to smell a bit like negligence.

We don't have any kids, thankfully - and are not having any in the future. My wife was literally recovering from a sterilisation procedure when the email arrived. So it seemed a bit weird that they'd send her a message like that.

My wife has never booked a child's fare. She's done nothing to indicate to them that she has spawned. They know that she's married and female, because she set her title to "Mrs". They got her date of birth from the ID checks they carried out - we think.

As far as we can tell, they've unilaterally decided that all married women of a certain age must have kids. Or, perhaps, they just lazily sent the message to all women?

So, she spoke to them, to ask why this specific piece of guff had been sent to her. All they'd say was the rather nebulous statement that the emails was a "targeted email sent to a number of passengers [...] When passengers use our services we're able to use this data to help us target communications effectively."

Not really answering the question. But they decided to bung us £20 of M&S vouchers for the "upset".

Even the most modest of interactions with a company will be data-mined for trivial details in the vague hope of getting you to spend more money.

Here are a few tips if you want to avoid getting microtargetted like this:

• Consider using a gender neutral title like Mx - or earn yourself a doctorate.
• Use an initial rather than a first name. Names can be used to determine likely age.
• Don't answer any demographic questions which aren't necessary to the provision of the service, or have a legal/regulatory basis.
• You generally can't unsubscribe from service emails, but you can close your account once you've finished your transaction. Digital hygiene is essential!

Of course, if you complain about a mistargeted email, that's another data-point they have about you!

Background

Virgin have a spammy DNS hijacking service. If you accidentally misspell a domain - for example example.coom - Virgin will pretend that the domain exists and serve you up an advertising page.

Yahoo powered! Yeuch! This means my data is sent to these advertisers without consent.

For the technically minded, the Virgin Media DNS should return NXDOMAIN instead it fraudulently returns NOERROR and redirects the user to the spam site.

Don't worry, there's a link to switch off the service.

But it is broken. It always says "the advanced network error search is already switched off."

Lots of people report having this problem but Virgin don't have an official fix for it. It is possible to change your devices' DNS servers - but it is impossible to change the DNS on the SuperHub. But, frankly, you shouldn't have to. Virgin should provide a proper DNS service.

So, here's how I got them to fix it. I hope this works for you too.

Raise a complaint

I raised an issue in the community forums. That's generally the best way to get in touch with the UK-based support team.

Eventually someone contacted me there and I was able to explain the issue. They started raising it with their IT team. But were unable to fix it.

I also raised a complaint directly with Virgin's complaints team.

After two months of being ignored, lied to, and misdirected - I asked for a Deadlock Letter. That allows you to make a complaint to the dispute resolution service.

Sadly, Virgin refused to issue a Deadlock. But as it had been longer than eight weeks, I was able to complain directly vis https://www.cedr.com/consumer/cisas/.

A couple of weeks later, I got a notification that my complaint had been accepted by CISAS. By complete coincidence I received a phone call from Virgin the exact same day offering me a solution!

Apparently the only way to change this setting was for Virgin to delete my customer account and rebuild it from scratch. Yup, their solution was to literally turn my account off then on again. Their only other option was to release me from my contract without penalty. As they're the only fibre provider near me, I let them switch me off for a couple of hours.

It didn't work.

The Data Protection Angle

I reckoned that if Virgin were sending my browsing data to a 3rd party without my consent, that was a GDPR issue. So I emailed Virgin's Data Protection team saying:

Virgin Media have forcibly enrolled my account into their "Advanced Network Error Search" service.

When I mistype a domain name, Virgin redirects me to an advertising service powered by Yahoo.

I would like to understand on what legal basis are you sharing my data with Yahoo and the advertising partners on the service. I see no mention of it in https://www.virginmedia.com/shop/the-legal-stuff/privacy-policy

As per your policy, I wish to assert the following rights:

5. The right to restrict processing

I have repeatedly asked your technical team to remove me from the Advanced Network Error Search service. They have refused. I am therefore instructing you to restrict the processing of my data for the purposes of this service.

Please let me know your response by 1st March.

I didn't hear back.

So I found their Head of Data Protection on LinkedIn and politely asked him to take a look into it for me. He told me to email a generic address. I explained that I had already done so but received no reply, so he gave me his direct address. I forwarded him the above, and got a swift reply saying they'd look into it.

A week later, I got a weird email saying my Web Safe Parental Controls had been changed.

I hadn't changed them. But, obviously someone at Virgin had monkeyed around with my account - because the accursed Advanced Network Error Search had gone!!

They phoned me shortly afterwards and confirmed that the issue had finally been resolved.

And all it took was three-months of complaining...

Compensation

Virgin offered a one month bill refund - £48 - by way of an apology.

In light of the months of arguing back-and-forth and the amount of time I wasted trying to get this fixed, I asked for £300 of compensation. Which they paid. (!!!!!!)

They separately also gave me bill credit for the delay in processing the case.

What Have We Learned?

Virgin media have shitty customer service. Their backend systems are antiquated and unreliable. But they have fastest speeds in my area and low(ish) prices, so I'm stuck with them.

But, more importantly, the threat of GDPR is an excellent way to force companies to behave!

Join Virgin Media and get £50 bill credit

If you fancy putting up with this sort of nonsense, join Virgin Media and we both get £50.

Luckily, she's not with EE - because it's a pretty convincing text. That domain name is specifically designed to include the day's date.

If you're stood up on a crowded train, with your phone screen cracked, would you notice that a . is where a / should be? A quick look at the URl shows a trusted domain at the start - followed by today's date.

It starts with https:// - that means it's secure, right? Is .info even recognisable as Top Level Domain?

Scammers know these domains get blocked pretty quickly - so there's no point registering a generic name like billing-pdf.biz only to have it burned within a day. By the time I'd fired up a VM to inspect it, major browsers were already blocking the site as suspicious.

Is there any way to stop this? No, not really. Domain names are cheap - you can buy a new .info for a couple of quid. The https:// certificate was freely provided by Let's Encrypt. The site was probably hosted somewhere cheap, and whose support staff are asleep when abuse reports come in from the UK.

And that's the price we pay for anyone being able to buy their own domain and run their own secure site.

Money and technical expertise used to be strong barriers to prevent people from registering scam domains. But those days are long gone. There are no technical gatekeepers to keep us safe. We have to rely on our own wits.

Twitter ads have always been a bit crap, but I've seen a recent influx in outright scams. Let me step you through a couple of examples.

A typical click-bait headline. What has our favourite celeb done this time?

In a moment of weakness, let's click through...

Straight away we can see that the branding on the site has been set up to mirror a popular news website.

The "article" is a poorly disguised get-rich-quick scheme. Spoiler Alert! You will not get rich quick - you will get poor rapidly.

This is the sort of advert which shouldn't get through a manual review. I'd argue that even automated tooling should be able to spot spam, scams, and frauds like this. But Twitter is completely asleep at the wheel here.

How do I know? Let's look at who promoted the ad. Usually these scams are pushed by dormant account, or by freshly created accounts. In this case, it is promoted by an ordinary user. And, it appears that they are entirely blameless - this advert did not originate with them.

The user claims they didn't post this. Someone has hijacked their account - probably by weak password reuse - and started spewing spam.

Why don't people spot this?

Twitter promoted posts don't have to show up on your timeline. Apple, for example, sends out lots of adverts like this:

Apple

@Apple

Join us September 12 at 10 a.m. PDT to watch the #AppleEvent live on Twitter. Tap ❤️ below and we’ll send you updates on event day. pic.x.com/i9mghtkhvu

---

But if you take a look at twitter.com/apple - it looks like they haven't ever tweeted!

If your account has been hijacked by a spammer, you won't know about it.

No tweet will show up on your timeline, and your followers won't be able to alert you. You cannot search for posts which have been promoted by you. The only way you'll find out if your account has been compromised is if people start replying to the advert.

As far as I can tell, a regular user can't delete a promoted Tweet from within Twitter. They have to use the Twitter Ad Platform. There is no way a normal user would know to do that.

It goes on

If you click the replies on promoted tweets, you'll regularly see similar comments. Users claiming to have been hacked, and being unable to remove the offending tweet.

Twitter has a problem with deceptive adverts - as I wrote earlier this year "Crypto Scammers Abusing Twitter Cards via Redirects".

You may think a promoted post is going to a site like CNN - but it could redirect you to a malicious site. For example, this promoted Tweet features Elon Musk and looks like it goes to CNN.com

If you're daft enough to click on it, you go to this page. A reasonably convincing clone of CNN. Full of stuff about how you can't lose money. Even has fake comments at the end, to give it legitimacy. But, you'll notice, it isn't a CNN domain. What's going on?

Twitter generates preview "cards" for web addresses. In this case, we can use the Twitter Card Validator to see that the website sends Twitter to CNN - but the user is redirected elsewhere.

In short - Twitter's advertising system is designed in such a way as to mislead the user about where their click will take them.

What can Twitter do to fix this?

Twitter could manually review adverts. Or make sure that the person promoting the tweet owns the domain they're linking to. Or require 2FA before allowing users to buy adverts. Or they could notify users that their account is being used for advertising. Or any one of a dozen ideas I'm sure the gang at Twitter could come up with during a lunch break.

Or they could respond to users who ask them for help.

Southern Charmer

@Fishblogger

Replying to @Support@TwitterSupport PLEASE DO SOMETHING ABOUT THIS SPAM! I cannot report it, delete it and a bunch of them keep popping up under my name that I did not post. It caused my computer to crash! Here is one of the links
x.com/fishblogger/st…

---

There are so many blatantly deceptive adverts on Twitter, that I can only conclude that generating revenue is more important than protecting their users. That's an unsustainable situation.

What can you do to stay safe?

When you click on a promoted Tweet, you have no way of knowing whether it was willingly sent by the user. You have no way of knowing where on the web that link will take you.

I urge you not to click on any Twitter adverts.

Whatever meagre protections they build in are rapidly evaded by the scammers. Let's take a look at an example of a promoted crypto-scam about Singapore. I'd say it was obviously a fake, but Twitter says this story comes from CNBC...!

Take a look at the bottom of the image - the CNBC domain name is there...

Diving into the source code of the ad, we can see that the link does not go to CNBC.

In fact, it goes to a crappy WordPress rip-off site on a completely different domain.

What's going on?

Twitter has a product called Twitter Cards which lets developers embed data on their page. These data are used to display large images, videos, and other stuff on the Twitter site.

What's curious is that there are no meta-tags on that spam site to populate the Twitter Card. So why does Twitter think the page is CNBC?

Using Twitter's Card Validator on that spam URl gives us this response:

When the spam site sees the Twitter Card Generator requesting the page, they redirect it to CNBC. Regular users are not redirected.

The Tweet was sent through the Twitter Ads Composer. Which, I guess, lets advertisers pick the image that they want to go with a link.

This is an obviously exploitable hole through which to spew disinformation.

Could this have been prevented?

The account "edayisagift" last Tweeted in 2017. It has a low follower count. I suspect it has been hijacked by spammers.

Should accounts like this be allowed to promote posts on Twitter? Is there a minimum quality threshold that should be met? Are there any ways to check adverts?

Even an automated check on common scam words, and recently reactivated accounts would help to prevent this sort of rubbish.

Perhaps they want to rely on crowdsourcing reports of bad behaviour?

The problem is, this spammy account has already been reported by reputable users - and nothing has been done about it!

Dave Kahn #FBPE

@dkahn400

This promotion is a scam. Reported to Twitter a couple of days ago, and it’s still being pushed.

---

Of course, crowdsourcing can also be gamed and manipulated. But this seems like such an obvious scam that I don't understand how it has been allowed to stand.

Recap

• Spammers are abusing Twitter cards to lend legitimacy to fraudulent adverts.
• Users report these scams.
• Nothing happens.
• Trust in the platform falls.

It is still going...

Terence Eden is on Mastodon

@edent

Crypto Scammers Abusing Twitter Cards via Redirects shkspr.mobi/blog/2019/03/s… pic.x.com/xunyfbwjz4

---

Terence Eden is on Mastodon

@edent

Replying to @edent*sigh* this crypto spammer is still going.
Abusing Twitter redirects to advertise a fake CNBC site shilling a scam coin.

How many times does this have to be reported before it gets taken down? pic.x.com/knkhsjcpvf

---