Imposing MT Subscriptions
An unpleasant situation has just happened.
My wife posted a resume on several sites. Periodically comes and updates.
Just 15-20 minutes ago, an unknown girl called from the number (7 499 704 16 31). Further dialogue:
Girl (D) : Good afternoon. Your resume is posted on one of our sites. The site does not automatically extend the publication. And in order to extend it for free, I’ll send you an SMS with a code, and then call you back and let me know it.
Wife (W) : Which site exactly?
D : I can not tell you, because we serve many sites.
J : Well, send.
')
At that time I was near, I immediately realized that this was a divorce.
After receiving the SMS all fears were confirmed. In SMS there was a code, the address of the site and the phone of the free support line.
Website address:www.RJob.tk. (46.182.24.228) Does not work anymore. Most likely it worked abu registrar.
The domain is clearly tied to the affiliate program.
The IP address seems to be from Selectk.
By 46.182.24.228 the authorization form is opened. It no longer opens. Most likely, Selectel worked. Well done.
The site below is a subscription terms. Although it does not matter.
Everything works through InkorMedia (numbers). The support number is 8-800-5555-638.
A couple of minutes after receiving the SMS, the girl called back.
D : Report the received code.
J : Please introduce yourself.
D : Victoria
Q : What is the name of your company?
D : Inmedia.
J : Girl, we checked the site from the text, looked at all the conditions. You are trying to sign me up on mt-subscription without my consent. All data about you will be transferred to the content provider.
D : Well, you don't want it - whatever you want.
Called incormedia. From a conversation with the operator of the call-center, since we did not transmit the code, then there is no need to worry, but the fact that they impudently impose the service so indifferently to them.
Now I'm trying to dig to which of the affiliate this domain is attached. I will unsubscribe later.
PS Honestly did not search for Habré about such schemes of fraud, perhaps already wrote earlier.
PSS Many are fought on this type of fraud. So be careful yourself and warn loved ones.
PSSS Resumes were posted on HH.ru, SuperJob.ru and regional site 59.ru
It turned out that some acquaintances were also called some time after placing the resume.
UP : found out billing, described the essence. Will understand.
UP2 : now fraudulent sites in the clouds
UP3 : billing was not the same, but this site previously worked through them and was blocked. Looking further.
UP4 : Another alternative to divorce: habrahabr.ru/blogs/infosecurity/134358/#comment_4460619
UP5 : Started :) Someone doesn’t like what is written about.
UP6 : Good note habrahabr.ru/blogs/infosecurity/134358/#comment_4461017
UP7 : Wrote a domain registrar.
In this scheme, fraudsters can work with any subject ads. For example, real estate, cars, etc. So be careful and careful.
UP8 : The site no longer opens.
UP9 : By ip also does not open, most likely worked in Selectle.
My wife posted a resume on several sites. Periodically comes and updates.
Just 15-20 minutes ago, an unknown girl called from the number (7 499 704 16 31). Further dialogue:
Girl (D) : Good afternoon. Your resume is posted on one of our sites. The site does not automatically extend the publication. And in order to extend it for free, I’ll send you an SMS with a code, and then call you back and let me know it.
Wife (W) : Which site exactly?
D : I can not tell you, because we serve many sites.
J : Well, send.
')
At that time I was near, I immediately realized that this was a divorce.
After receiving the SMS all fears were confirmed. In SMS there was a code, the address of the site and the phone of the free support line.
Website address:
The domain is clearly tied to the affiliate program.
The IP address seems to be from Selectk.
The site below is a subscription terms. Although it does not matter.
Everything works through InkorMedia (numbers). The support number is 8-800-5555-638.
A couple of minutes after receiving the SMS, the girl called back.
D : Report the received code.
J : Please introduce yourself.
D : Victoria
Q : What is the name of your company?
D : Inmedia.
J : Girl, we checked the site from the text, looked at all the conditions. You are trying to sign me up on mt-subscription without my consent. All data about you will be transferred to the content provider.
D : Well, you don't want it - whatever you want.
Called incormedia. From a conversation with the operator of the call-center, since we did not transmit the code, then there is no need to worry, but the fact that they impudently impose the service so indifferently to them.
Now I'm trying to dig to which of the affiliate this domain is attached. I will unsubscribe later.
PS Honestly did not search for Habré about such schemes of fraud, perhaps already wrote earlier.
PSS Many are fought on this type of fraud. So be careful yourself and warn loved ones.
PSSS Resumes were posted on HH.ru, SuperJob.ru and regional site 59.ru
It turned out that some acquaintances were also called some time after placing the resume.
UP : found out billing, described the essence. Will understand.
UP2 : now fraudulent sites in the clouds
UP3 : billing was not the same, but this site previously worked through them and was blocked. Looking further.
UP4 : Another alternative to divorce: habrahabr.ru/blogs/infosecurity/134358/#comment_4460619
UP5 : Started :) Someone doesn’t like what is written about.
UP6 : Good note habrahabr.ru/blogs/infosecurity/134358/#comment_4461017
UP7 : Wrote a domain registrar.
In this scheme, fraudsters can work with any subject ads. For example, real estate, cars, etc. So be careful and careful.
UP8 : The site no longer opens.
UP9 : By ip also does not open, most likely worked in Selectle.
Source: https://habr.com/ru/post/134358/
All Articles