{"id":13,"date":"2017-08-18T17:18:15","date_gmt":"2017-08-18T15:18:15","guid":{"rendered":"https:\/\/binaryvikings.io\/?p=13"},"modified":"2017-09-28T09:27:50","modified_gmt":"2017-09-28T07:27:50","slug":"facebook-scamiversary","status":"publish","type":"post","link":"https:\/\/binaryvikings.io\/?p=13","title":{"rendered":"Facebook Scamiversary"},"content":{"rendered":"<p>Hi everyone!<br \/>\nI started noticing a lot of these Facebook anniversary scams on my wall. The scams are in my case in Danish, and are currently targeting Scandinavia, where I live. (The SAS scam is also showing up in Swedish and Norwegian). But I&#8217;m not doubting for a second that these won&#8217;t pop up in other countries as well.<\/p>\n<p>First off, I&#8217;ll just show a couple of them, and how they look.<\/p>\n<h1>The ScamDinavian Airlines on Facebook<\/h1>\n<h2>How it looks<\/h2>\n<p>The first one is this; Scandinavian Airlines, SAS, is giving out 2 free tickets for their 71-year anniversary, as shown below.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-14\" src=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/SASinitial-300x271.png\" alt=\"\" width=\"300\" height=\"271\" \/><br \/>\nThe post comment reads &#8220;<strong>Tak #SAS<\/strong>&#8220;, meaning &#8220;<strong>Thanks #SAS<\/strong>&#8220;. Noticable here is, that sas-denmark.com is not actually a domain, owned by Scandinavian Airlines. (Read more on how to know, below)<\/p>\n<p>Once you click the post, you&#8217;ll be met with the following screen.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-15 size-full\" src=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/SAS-questionairre.png\" alt=\"\" width=\"1706\" height=\"701\" srcset=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/SAS-questionairre.png 1706w, https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/SAS-questionairre-300x123.png 300w, https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/SAS-questionairre-768x316.png 768w, https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/SAS-questionairre-1024x421.png 1024w, https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/SAS-questionairre-1140x468.png 1140w\" sizes=\"auto, (max-width: 1706px) 100vw, 1706px\" \/><\/p>\n<p>You are faced with 3 different questions, where first question is: &#8220;Have you ever traveled with us?&#8221; &#8211; with possible answers: &#8220;Yes&#8221; and &#8220;None&#8221;. Yes, indeed, it translates to &#8220;<strong>none<\/strong>&#8221; and not &#8220;<strong>no<\/strong>&#8220;. Also worth mentioning is that there is always&#8230;.. always&#8230; 764 tickets left.<\/p>\n<p>All 3 questions will be as easy to answer. And here&#8217;s why.<br \/>\nOnce you answer the third question, you get the following screen:<br \/>\n<a href=\"https:\/\/binaryvikings.io\/?attachment_id=16\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-16 size-full\" src=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/SASdone.png\" alt=\"\" width=\"803\" height=\"937\" srcset=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/SASdone.png 803w, https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/SASdone-257x300.png 257w, https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/SASdone-768x896.png 768w\" sizes=\"auto, (max-width: 803px) 100vw, 803px\" \/><\/a><\/p>\n<p>First thing you have to do after completion, is to click &#8220;<strong>Share<\/strong>&#8220;, and then write &#8220;<strong>Tak #SAS<\/strong>&#8220;.<br \/>\nStep 2, you have to click the like button, and then it&#8217;s &#8220;waiting for verification&#8221;.<\/p>\n<h1>The Marlboro scam<\/h1>\n<p>There is an equal one for Marlboro, stating that Marlboro will give away 5 cartons of cigarettes to all! On their 100th anniversary.<\/p>\n<p><a href=\"https:\/\/binaryvikings.io\/?attachment_id=17\" rel=\"attachment wp-att-17\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-17\" src=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/Initial-300x250.png\" alt=\"\" width=\"300\" height=\"250\" srcset=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/Initial-300x250.png 300w, https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/Initial.png 484w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>That does sound quite impressive, as 1 pack of Marlboro costs 44 DKK (~5.9 EUR). So they are said to be handing out cigarettes, worth of\u00a02.200 DKK (~300 EUR) to\u00a0<strong>everybody<\/strong>.<\/p>\n<p><a href=\"https:\/\/binaryvikings.io\/?attachment_id=18\" rel=\"attachment wp-att-18\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-18 size-full\" src=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/Marlboro-questionairre.png\" alt=\"\" width=\"1735\" height=\"700\" srcset=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/Marlboro-questionairre.png 1735w, https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/Marlboro-questionairre-300x121.png 300w, https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/Marlboro-questionairre-768x310.png 768w, https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/Marlboro-questionairre-1024x413.png 1024w, https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/Marlboro-questionairre-1140x460.png 1140w\" sizes=\"auto, (max-width: 1735px) 100vw, 1735px\" \/><\/a><\/p>\n<p>As seen above, you get sent to this page, same as the SAS page, with 3 easy questions. This question reads: &#8220;Have you ever smoked Marlboro?&#8221;, with possible answers: &#8220;Yes&#8221;, &#8220;None&#8221;, &#8220;Remember not&#8221;. The language is full of amazing grammar, any Danish teacher would be proud (not).<\/p>\n<h1>How to know it&#8217;s fake<\/h1>\n<h2>Language<\/h2>\n<p>When the target pages start out with, eg.<\/p>\n<ul>\n<li>&#8220;You have been selected to participate in&#8230;&#8221;<\/li>\n<li>&#8220;Hurry! Only X amount left&#8230;&#8221;<\/li>\n<\/ul>\n<p>Additionally the text is very poorly translated, such as the answer buttons. Also the posts themselves are not grammatically correct, which we can assume they would be, if big companies, such as Marlboro or Scandinavian Airlines actually did make a contest or whatever this could be called. Last but not least, some of the text is not even translated!<\/p>\n<h2>Domains<\/h2>\n<p>It&#8217;s always a good idea, to check the root of the domain. The domain here is:<\/p>\n<p><a href=\"https:\/\/binaryvikings.io\/?attachment_id=19\" rel=\"attachment wp-att-19\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19\" src=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/Capture.png\" alt=\"\" width=\"222\" height=\"45\" \/><\/a><\/p>\n<p>In this case, you can try to go to marlboro-dk.com to see what it shows. Not to mention that the <img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-31\" src=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/i-logo.png\" alt=\"\" width=\"25\" height=\"21\" \/>\u00a0in front of the URL, meaning the connection between you and the server is un-encrypted. Which it would\/should never be. Going to marlboro-dk.com shows as follows:<\/p>\n<p><a href=\"https:\/\/binaryvikings.io\/?attachment_id=20\" rel=\"attachment wp-att-20\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-20\" src=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/nodomain-300x240.png\" alt=\"\" width=\"300\" height=\"240\" srcset=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/nodomain-300x240.png 300w, https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/nodomain.png 423w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>This clearly shows that the website is empty and already now, you should be 100% sure and close the page. However, it&#8217;s easy to set up a redirect from marlboro-dk.com to the actual page of Marlboro, so you can&#8217;t rely on this, if it sends you to the company&#8217;s website.<\/p>\n<p>You can then go to<a href=\"https:\/\/www.whois.com\/\" target=\"_blank\" rel=\"noopener\">\u00a0https:\/\/www.whois.com\/<\/a>\u00a0and search for the domain in question, which will show the following for the two domains:<\/p>\n<p><a href=\"https:\/\/binaryvikings.io\/?attachment_id=22\" rel=\"attachment wp-att-22\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-22\" src=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/marlborodomain-300x148.png\" alt=\"\" width=\"300\" height=\"148\" srcset=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/marlborodomain-300x148.png 300w, https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/marlborodomain.png 376w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>Marlboro, which is seen above. As seen, it states; &#8220;<strong>Domain Name: marlboro-dk.com<\/strong>&#8220;, and further below, is says the domain was created 15th of August 2017. For sure Marlboro has been around for more than a couple of days.<\/p>\n<p><a href=\"https:\/\/binaryvikings.io\/?attachment_id=21\" rel=\"attachment wp-att-21\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-21\" src=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/sasdomain-300x157.png\" alt=\"\" width=\"300\" height=\"157\" srcset=\"https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/sasdomain-300x157.png 300w, https:\/\/binaryvikings.io\/wp-content\/uploads\/2017\/08\/sasdomain.png 382w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>SAS, as seen above, states\u00a0&#8220;<strong>Domain Name: sas-denmark.com<\/strong>&#8220;, and further below, says the domain was created the 14th of August 2017. I&#8217;m also pretty sure that SAS has been around, with a Danish website, being SCANDINAVIAN Airlines, for more than just a couple of days.<\/p>\n<h1>Why &#8220;they&#8221; would do this to you<\/h1>\n<p>Now you might be asking; &#8220;But why, Brian? Why would they be so mean to me, and have me answer questions for no reason?&#8221;.<\/p>\n<p>There can be a number of reasons, why people would set up these sites, a couple of examples could be&#8230;<\/p>\n<ul>\n<li>Money from advertisements when you click. (imagine something like this, spreading on social media, with them earning per time you click).<\/li>\n<li>Building up a network of people for the next big scam.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Think before clicking, sharing and liking things!<\/p>\n<p>Out,<br \/>\nBrian<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hi everyone! I started noticing a lot of these Facebook anniversary scams on my wall. The scams are in my case in Danish, and are<\/p>\n","protected":false},"author":1,"featured_media":14,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_eb_attr":"","footnotes":""},"categories":[1],"tags":[4,3],"class_list":["post-13","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-securiscam","tag-scam","tag-security"],"_links":{"self":[{"href":"https:\/\/binaryvikings.io\/index.php?rest_route=\/wp\/v2\/posts\/13","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/binaryvikings.io\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/binaryvikings.io\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/binaryvikings.io\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/binaryvikings.io\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=13"}],"version-history":[{"count":9,"href":"https:\/\/binaryvikings.io\/index.php?rest_route=\/wp\/v2\/posts\/13\/revisions"}],"predecessor-version":[{"id":150,"href":"https:\/\/binaryvikings.io\/index.php?rest_route=\/wp\/v2\/posts\/13\/revisions\/150"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/binaryvikings.io\/index.php?rest_route=\/wp\/v2\/media\/14"}],"wp:attachment":[{"href":"https:\/\/binaryvikings.io\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=13"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/binaryvikings.io\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=13"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/binaryvikings.io\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=13"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}