Spambots on FB target horseworld!

[Plainandtall]

OK COTHers… I’ve been trying to battle this alone and I’m having a really hard time getting anyone to give a hoot… especially facebook. This situation has me really creeped out because it’s so narrowly targeted and executed. Facebook is NOT doing anything about it- and they could seriously clean house if they were willing to- but for whatever creepy sinister reason- they won’t.

I wish I could alert the whole horseworld and that together we could push them out.

For starters, I’m going to intentionally mangle the name of the website and I’m going to implore you to not type the name of the website in a way which is searchable- because that will result in making it harder to run clean searches when I try to find posts coming from the spambots. Capisce?

Also- I’d advise you to not go to the website as it may have malware, it certainly has lots of ads. The website is hosted from the city of Vales Macedonia which is a known hotbed of hackery.

So anyway I am a member of a very narrow focus horse page, and two days in a row this beautiful redhead chick named Natasa posts videos to our group that ARE horse videos- but have nothing to do with our focus… to top it off- the videos are really violent awful movies of no redeeming equestrian value (a hidden camera of a stablehand beating a horse and a catastrophic racing accident) The videos are just lifted from youtube and hosted on a clickbait site called Horses (then the #ninetynine with no space) DOT com.

Annoyed, I reverse google image search her profile picture which goes back to a German Porn site. Her profile banner picture is a stolen stock photo with horses in it.

So then I check out “her” small but very good looking assortment of “friends” and a huge number of them are very good looking people posed with horses and with horses as the banner. All stolen professional pictures, many of them cluster so that you can actually see the search words the spambot builder used (“man with horse” ) to collect web pictures to use building the fake equestrian profiles. **also “man with beard” “man with fish”

One of the profiles stands out to me a bit different from the others- I reverse image search that photo and discover that both the photo and the woman’s actual name have been stolen off the webpage of a small town American business. I telephone the real woman to inform her about the imposter profile on FB (This was two weeks ago- the imposter profile is still active)

so then I think- if “Natasa” is posting links to the page I’m on… where else are she and her fake equestrian friends posting?

So I do a FB search for the name of the website- BAMMO- tons of results- equestrian spambots posting all over-posting horse themed clickbait video tied to a website with a name that has the word horses in it. It’s not like some guy named Sim Lau posting cheak oakley sunglasses… I mean screams spam- we get that… but Someone is going through the effort to make a fake horse website and then make fake horse profiles to push it into the horseworld? Why?? Hitting hard especially in the UK- on lots of local tack swap pages (which have suspiciously large memberships) They are just carpetbombing the horse world with their clickbait spam.

I’m not a member of these groups so I can’t warn them or discuss it with the moderators. I try joining a few of the groups and amazingly- some pages remove my warnings and allow the spambots and their posts to remain.----------- What to make of this? Honestly (I have my tin foil hat on) I think that these groups have gone rogue- either they were created by an entrepreneur with the intention to provide a gathering point of real horsepeople who could then be targeted-- or they were sold to someone-- or the permission to have access to the members was sold (there is a black market for such things) Pages with more members have a higher value and frequently pages pay for fake likes to boost their apparent popularity.

I recently found that the aforementioned Macedonian website also has created their own FB page which now has 6,607 members, up 1000 from last week. One of my own FB friends has liked the page and hasn’t unliked it even after I told her the whole thing is fakey coming out of Macedonia- maybe some of your friends have liked it too- its called * I Love My Horse *

If you are actually following this creepy tail and if you have looked to see with your own eyes the bits of the story- you will see that all of the photos on that page- are the same collection of photos used for the background banners of the fake profiles. All of the posts go to that one website. One big self fulfilling perpetual cycle of scamminess.

Oh… speaking of Cycles. Natasa also has a bunch of motorcycle friends. They are all georgous hipster male models with beards. They are doing the same thing in the motorcycle world- only the websites they are pushing are named with motorcycle names and baited with motorcycle videos.

And Natasa also has Snowmobile friends…

And Fishermen friends- who all have caught trophy fish and posed in pictures that appear on the covers of fishing magazines.

And they are all right there as plain as day and FB will not DO.A.THING. about it.

So check your groups- learn the MO. Pay attention and if you are a FB page moderator be alert, protect your members. I have explained how to work backwards. FB’s solution to report a SINGLE POST and then block YOURSELF from seeing any more from that one specific fake profile- does NOTHING to clean up a huge network of potential harm.

I have found another “family” of spambots associated with another website who somehow have stolen profile pictures which do not return in google image searches. I don’t know how they pulled that off- but I do know that assistant professors at Yale don’t pose for portraits with a duck face.

[Halt_Near_X]

[QUOTE=Plainandtall;8671519]
Someone is going through the effort to make a fake horse website and then make fake horse profiles to push it into the horseworld? Why?? [/QUOTE]

Because it works.

People learned a long time ago to be suspicious of obviously fake profiles, so now the scammers/spammers are creating more realistic profiles. When people learn how to spot those, they’ll make them even more realistic.

It probably doesn’t take all that much effort. Much of what you describe can be automated and then reused (e.g. one version for horses, one for motorcycles, etc). And for the effort it does take, well, that’s their job. Whatever they get from people who fall for their scheme is clearly worth the effort they put in to it, or they wouldn’t bother.

Nothing new or exciting in what you are seeing.

[Kwill]

The internet is a scary place, full of dark alleys, lurking strangers, and the damned. Beware.

Run a firewall, don’t friend people you don’t know, and get good malware fighting software. Change your passwords often and make them secure.

Facebook thrives on ads and clicks, so they aren’t going to do much about scammers. As Halt Near X said, they clearly are getting something out of this, could be phishing, maybe they are trying to install malware, who knows.

[dotneko]

OK, what? I was lost after the first sentence.
Is there a cliffnotes version?

[Plainandtall]

[QUOTE=dotneko;8671854]
OK, what? I was lost after the first sentence.
Is there a cliffnotes version?[/QUOTE]

Sure.

A next generation of spammer has arrived in the facebook horseworld.

The spam no longer looks like obvious spam. Now the spam looks like horse related internet content (clickbait).

The website has a horsey sounding name.
The Clickbait had horses in it.
The spambots promoting the pages look like equestrian profiles.
They are posting in many horse groups, especially UK groups.

The scammy clickbait website is registered in Macedonia.
There is also a FB page called I love My Horse driving traffic to that same website.

Real horse people, in general, have not yet learned to recognise this style of spam.
FB will not delete this large network of fake profiles.
I am trying to alert the horse world to this.

[caper]

And that there is another reason I don’t bother with FB.

[dotneko]

Much easier to understand. Thanks

[Kwill]

So what does the clickbait site have in mind for the unwary?

I went to the I love my horse site, looks like they are trying to sell apparel that says I heart my horse on it. Who knows. The other site, as you said, has a bunch of videos.

Not sure what the scam is here…but I didn’t click the videos on the other site you mentioned. I also went anonymous when I was looking at them.

[Plainandtall]

Honestly Kwill, I don’t know. It’s possible that it’s something as simple and “honest” as getting the ad revenue from having a website that gets a lot of views. But creating a network of fake profiles to promote your website on FB is a really low thing to do as it undermines and manipulates real people and the “real” communities they have built.

It’s also possible that the website installs malware or spyware when you click on popups to cancel them out.

I also have concern for the fact that many of the groups involved are tack swap/ sale pages and that many real people are trying to do business with each other in what should be a wonderful format that assists the horse community- and I’m concerned that the “sale” nature of those groups is ripe for exploitation.

Looking at how the motorcycle branch of this network has developed- the websites are slicker and even more believable, and many of the fake motorcycle profiles are gaining “real” friends which give their profile a stamp of approval if a mod tries to check the validity of a fake profile and they share several people in common.

[ReSomething]

Well, I know that one member of a group on Fb was hacked by a type of porn site that posted to all his groups, with a lovely large video thumbnail. the discussion there after the mod removed it, and probably him too, was that accessing Fb with your mobile device in certain public places can expose your account to hacking.
The sale nature of those groups has always been ripe for exploitation though when you consider all the shopped items that appear on for example Craigslist, they were bound to migrate to Facebook groups, it’s entirely up to the mods of each group to police the group.
I hate to think what the ultimate desire is of the originators, revenue without a doubt but how far will they take that?

[Kwill]

So an interesting twist… I looked at the I Love Horses thing yesterday… did not click on any of the links. Obviously did not follow it.

This morning, on my news feed there it is, and I am following it, apparently. I was quite shocked to see it there. I unfollowed immediately. So thank you OP for alerting to this.

Regardless of how it got there, it’s clear there is some sophisticated technology at least to target people’s FB feed.

[Plainandtall]

There are a bunch of pages with similar names variations of I love horses and I love my horse. I’m getting confused because it won’t come up when I search directly- but when I search for the name of the website- I can find results featuring the page.

The page I originally was talking about, 'I love my horse" and has a FB url with hyphens I-love-my-horse Currently has a profile square picture featuring a black and a white shire running in snow- the background picture is a Friesian with a dark dusky brown sunset. That’s the page with the links to the clickbait website and all the photos are the files used to build the fake profiles.

There is another page called “I love horses” that is all Jewelry posts… spammy scammy jewelry. This time the Friesian with the brown sunset is the profile square and some camargue whites with sea grass are the background. The website for the jewelry is called PLUTO(#ninetynine)DOT com seems obviously linked to the other website.The Pluto domain registrant is hidden by a third party based in queensland.

Then we have ANOTHER I love my horse which has a drafty chestnut for a profile square and the camargue whites for the background. This site is selling clothing and jewelry and their store, finders keepers store dot com, also has a private domain registration this one in Canada.

One more I love my horses and this one has a cobby black in profile and the camargue whites for the background- this page was abandoned back in December of 2015 and was selling t shirts through represent.

it just doesn’t end.