Battle for a client or how to find a spammer
Three and a half weeks ago (September 24), one of the clients called our office and asked in an agitated voice: “Is it true that you are closing? And I just added balance in the system yesterday. What will happen to my money? ”
A slight shiver ran through the manager, because he also did not plan to remain without work, but after a short pause he managed to pull himself together and find out what happened. How to find a distributor of false information (hereinafter referred to as "spammer", because in our cases spam sending phishing emails occurred) about your company on the Internet and how to react if someone begins to threaten you and your customers read further.
')
On September 24, the customers of Call Us received a letter stating that the Call Up company is closing, we suggest you become a customer of the LPTracker service. The implication was that the client who read this letter would take it as a notification from the company itself, so a mailbox pozvonim@inbox.ru was created for mailing.
Pic.1 Screenshot of spam emails sent to pozvonim.com
The sender's expectations were justified, indeed, many people perceived this letter, and calls from customers fell to the office.
Our representative contacted the company listed in the mailing list, told about the dissemination of false information by their partner, about sending spam and asked to block the link. Soon the link was blocked, but after 5 minutes it was made active again. Our telephone numbers were blacklisted; they stopped responding to letters and messages via other communication channels.
As time went on, the company completely abstracted from us while continuing to collect transitions.
Realizing that the competing company does not plan to go on a constructive dialogue and block the spammer, we wrote an article about this incident and placed it on thematic resources, primarily in the mega brain. The main goal was to block the link, but it continued to be active. And along with it appeared activity and our spammer.
At one of the resources, where the article was also posted, he gets an account and starts threatening us with new spam mailings if we do not delete the article, which in his opinion tarnishes the reputation of LPTracker (hereinafter LP). In the same place, in the comments, he confesses that it was the mailing that was made, and not the sending of several letters.
Fig.2. Deleted comment in which the spammer is trying to prove that the company is not associated with him, and if we do not believe it, he will bring down new mailings to us.
For unknown reasons, the news resource deleted these comments, but the screenshots we have saved.
Lesson 1: Save all the evidence at once, not after a while. After a while they may no longer be, and only you alone will know the truth.
At the same time, there were threats by e-mail, so we set ourselves the task of examining each pixel in a provocative letter, but finding the one who sent it and continues to threaten it.
Fortunately, this was not required.
Read carefully the letter that started it all.
It was:
Fig.3. Excerpt from email with spammer partner ID
This promo code promo4807 is used to identify the company LP, where the client came from and from which partner (if the partner recommended them). Check to make sure google knows about this affiliate id.
Promo 4807 turned out to be very popular, it was posted on the official pages of LPtracker on behalf of. Representatives, was used in social. Networks, as a link to register to the video clips that the company regularly records and puts on YouTube and so on. Below are a few screenshots where this is demonstrated:
rice 4. Ivan Bochenkov, advertises the LP service under the partner identifier 4807. By the way, again due to the name of a competing company
rice 5. The official representative of the company lptracker on the pairing, when you click in detail you can see the same screenshot as in the mailing list and the same promo code 4807. And this is Ivan again
rice 6 Detailing, when you click on a comment.
Fig.7 Comments Ivan on Sparks, as of. A company representative on the Internet. As you can see, accepts user requests and writes on behalf of "We" - that is, the company.
In addition, in a phishing letter, Ivan also pointed out: "Gookit.com is a service for publishing and sending commercial offers, announcements and articles" - this site is registered with Ivan Bochenkov.
Fig.8 excerpt from the letter
Fig.9. Issuance to google when entering affiliate links 4807.
As we see, the same projects of the same person fall out.
Of course, the Internet allows you to keep some anonymity, but when you already know the participants in the conspiracy, you can identify certain patterns.
In the figure below, two accounts on the information resource on which the spammer contacted us. Alexandrovich account - spammer account, in which he himself admitted in the comments, and Nicolas account ... - Ivan account, were on the site at the same time. More precisely, the spammer first came in, corresponded with us, and later Ivan came in.
Fig. 10 Two accounts by Ivan
Continuation of a story:
Affiliate link 4807, through which spam transitions are active for the third day, the LP company does not get in touch, has blocked all our contacts. We posted an article about this, which became very disturbing to the "spammer" and he began to demand its removal, threatening with new newsletters.
The question immediately arose: why a spammer, so worry about the service and ask to delete those articles, in every way denying their involvement in the LP.
By the middle of the 3rd day, the “spammer” began to cover its tracks. Promo code 4807 placed on the official pages of the company LP, in the social. Networks, forums, YouTube, news and other sources changed to another.
This explained why the spam link was unlocked after 5 minutes. As soon as they blocked it, the LP company had to change the promo code in all official mentions about them on the Internet, because the old one stopped working. Ie, by blocking partner 4807, they blocked themselves.
As soon as the promo code was changed, the malicious link 4807 was blocked.
Lesson 2: Do not forget about lesson 1. Save all the evidence at once, take screenshots, video.
Fig. 11 The company LP blocked the link, confirming the fact that they understood all this time about the violation of the rights of third parties.
But the incident article continued to harass the spammer and the LP.
The spammer even called us on a personal cell phone, the same number from which we tried to contact the LP when we saw the newsletter. Where did he get this number? It is not used anywhere in open sources. Other employees of the Liberal Party began calling us on the same number with a demand to remove the article, then they received threatening calls ...
After a while, Ivan’s friend, Sergei Arsenichev, also decides to send out letters on the basis of Ivan, but about his LeadBack service.
Fig.12 Chronology of events, restored with the help of information from open sources.
Lesson 3. If you have not responded and forgive the infringement of your rights, they will be constantly infringed. You should not hope that the situation will not happen again.
In the course of our mini-investigation, we managed to find a lot of evidence of the involvement of the above-mentioned persons in the discrediting mailing list. There is no goal to bring them all in this article, so we will not do that.
Certification of documents cost us about 60 thousand rubles. However, now we have not just screenshots, the authenticity of which can be questioned, but certified documents with the help of which you can protect your rights.
The dispatch produced discredited us in the face of our clients, we received a lot of negativity and consequences, but it is difficult to calculate the material damage from this. In addition, by the time the company blocked the link, we had already paid for notary services and legal advice.
Litigation requires additional financial costs and lasts a long time, so always try to negotiate compensation for your damage peacefully, you may be able to compensate for some of your losses. We also tried to do this and wrote a letter to the PL. In our cases, there was no constructive dialogue: the company wrote that they did not intend to protect the spammer (i.e., their official representative, Ivan Bochenkov), this is completely his responsibility and we must make all claims personally to him, and they will not specify who spammer
And at this time, the spammer continues to defend the honor of the company, threatens us in correspondence by email, writes letters on our behalf to customers using profanity.
Most likely, your mailing case is not the only one and the person who has been doing this has already offended someone before you. Collect this information, people often write in open sources about such incidents. They will be able not only to characterize your personality, in our case, the “spammer”, but they will surely know his contact and other data.
Ivan Bochenkov turned out to be no exception, we found freelancers on the network, whom he did not pay for work, threatened spam with newsletters through their contacts about what they were “losers”, insulted with obscene expressions and so on. In general, he did everything the same thing that our spammer did and does.
One of the freelancers lost his official job as he decided to demand payment for the work done from Ivan. In his words, Ivan talked to his supervisor, and the next day the freelancer was fired without explanation.
Fig. 13 Post in social. Nets about designer cheating
Fig. 14. Feedback on Ivan in the list of customers who do not pay orders
vk.com/photo-51016572_370984336
Fig. 15. The manner of communication Ivan. An excerpt from the correspondence with one of the freelancers whom Ivan did not pay, however, from the words of the freelancer himself, used his works.
Each story of interactions with freelancers is a separate story that requires a separate investigation, but we can conclude for ourselves that if such stories happen, it’s not just that they give a certain characteristic to a person by the very fact of their existence.
Step 6. Send the information you have to the competent authorities and write a statement
Now that you have gathered all the information and facts about the incident that occurred, when you have feedback describing the participants, transfer all your data to the competent authorities. They will establish the fact of possible fraud in your address.
If this article was useful to you, then how to apply, in what instances and what happens next, we will write in the next section.
Lesson 4. As Warren Buffett said: “It takes 20 years to build a reputation, and 5 minutes to destroy it” and do not trust the development of your project to doubtful people.
Ps.: While we were writing this news, Ivan became active again and now sends spam in the interests of Sipuni.com - but this is another story.
A slight shiver ran through the manager, because he also did not plan to remain without work, but after a short pause he managed to pull himself together and find out what happened. How to find a distributor of false information (hereinafter referred to as "spammer", because in our cases spam sending phishing emails occurred) about your company on the Internet and how to react if someone begins to threaten you and your customers read further.
')
Beginning of the story:
On September 24, the customers of Call Us received a letter stating that the Call Up company is closing, we suggest you become a customer of the LPTracker service. The implication was that the client who read this letter would take it as a notification from the company itself, so a mailbox pozvonim@inbox.ru was created for mailing.
Pic.1 Screenshot of spam emails sent to pozvonim.com
The sender's expectations were justified, indeed, many people perceived this letter, and calls from customers fell to the office.
Our representative contacted the company listed in the mailing list, told about the dissemination of false information by their partner, about sending spam and asked to block the link. Soon the link was blocked, but after 5 minutes it was made active again. Our telephone numbers were blacklisted; they stopped responding to letters and messages via other communication channels.
As time went on, the company completely abstracted from us while continuing to collect transitions.
Step 1. Write about the incident in the media
Realizing that the competing company does not plan to go on a constructive dialogue and block the spammer, we wrote an article about this incident and placed it on thematic resources, primarily in the mega brain. The main goal was to block the link, but it continued to be active. And along with it appeared activity and our spammer.
At one of the resources, where the article was also posted, he gets an account and starts threatening us with new spam mailings if we do not delete the article, which in his opinion tarnishes the reputation of LPTracker (hereinafter LP). In the same place, in the comments, he confesses that it was the mailing that was made, and not the sending of several letters.
Fig.2. Deleted comment in which the spammer is trying to prove that the company is not associated with him, and if we do not believe it, he will bring down new mailings to us.
For unknown reasons, the news resource deleted these comments, but the screenshots we have saved.
Lesson 1: Save all the evidence at once, not after a while. After a while they may no longer be, and only you alone will know the truth.
At the same time, there were threats by e-mail, so we set ourselves the task of examining each pixel in a provocative letter, but finding the one who sent it and continues to threaten it.
Fortunately, this was not required.
Step 2. Return to the beginning.
Read carefully the letter that started it all.
It was:
Fig.3. Excerpt from email with spammer partner ID
This promo code promo4807 is used to identify the company LP, where the client came from and from which partner (if the partner recommended them). Check to make sure google knows about this affiliate id.
Promo 4807 turned out to be very popular, it was posted on the official pages of LPtracker on behalf of. Representatives, was used in social. Networks, as a link to register to the video clips that the company regularly records and puts on YouTube and so on. Below are a few screenshots where this is demonstrated:
rice 4. Ivan Bochenkov, advertises the LP service under the partner identifier 4807. By the way, again due to the name of a competing company
rice 5. The official representative of the company lptracker on the pairing, when you click in detail you can see the same screenshot as in the mailing list and the same promo code 4807. And this is Ivan again
rice 6 Detailing, when you click on a comment.
Fig.7 Comments Ivan on Sparks, as of. A company representative on the Internet. As you can see, accepts user requests and writes on behalf of "We" - that is, the company.
In addition, in a phishing letter, Ivan also pointed out: "Gookit.com is a service for publishing and sending commercial offers, announcements and articles" - this site is registered with Ivan Bochenkov.
Fig.8 excerpt from the letter
Fig.9. Issuance to google when entering affiliate links 4807.
As we see, the same projects of the same person fall out.
Of course, the Internet allows you to keep some anonymity, but when you already know the participants in the conspiracy, you can identify certain patterns.
In the figure below, two accounts on the information resource on which the spammer contacted us. Alexandrovich account - spammer account, in which he himself admitted in the comments, and Nicolas account ... - Ivan account, were on the site at the same time. More precisely, the spammer first came in, corresponded with us, and later Ivan came in.
Fig. 10 Two accounts by Ivan
Continuation of a story:
Affiliate link 4807, through which spam transitions are active for the third day, the LP company does not get in touch, has blocked all our contacts. We posted an article about this, which became very disturbing to the "spammer" and he began to demand its removal, threatening with new newsletters.
The question immediately arose: why a spammer, so worry about the service and ask to delete those articles, in every way denying their involvement in the LP.
By the middle of the 3rd day, the “spammer” began to cover its tracks. Promo code 4807 placed on the official pages of the company LP, in the social. Networks, forums, YouTube, news and other sources changed to another.
This explained why the spam link was unlocked after 5 minutes. As soon as they blocked it, the LP company had to change the promo code in all official mentions about them on the Internet, because the old one stopped working. Ie, by blocking partner 4807, they blocked themselves.
As soon as the promo code was changed, the malicious link 4807 was blocked.
Lesson 2: Do not forget about lesson 1. Save all the evidence at once, take screenshots, video.
Fig. 11 The company LP blocked the link, confirming the fact that they understood all this time about the violation of the rights of third parties.
But the incident article continued to harass the spammer and the LP.
The spammer even called us on a personal cell phone, the same number from which we tried to contact the LP when we saw the newsletter. Where did he get this number? It is not used anywhere in open sources. Other employees of the Liberal Party began calling us on the same number with a demand to remove the article, then they received threatening calls ...
After a while, Ivan’s friend, Sergei Arsenichev, also decides to send out letters on the basis of Ivan, but about his LeadBack service.
Fig.12 Chronology of events, restored with the help of information from open sources.
Lesson 3. If you have not responded and forgive the infringement of your rights, they will be constantly infringed. You should not hope that the situation will not happen again.
Step 3. Verify the evidence with a notary
In the course of our mini-investigation, we managed to find a lot of evidence of the involvement of the above-mentioned persons in the discrediting mailing list. There is no goal to bring them all in this article, so we will not do that.
Certification of documents cost us about 60 thousand rubles. However, now we have not just screenshots, the authenticity of which can be questioned, but certified documents with the help of which you can protect your rights.
Step 4. Try to arrange
The dispatch produced discredited us in the face of our clients, we received a lot of negativity and consequences, but it is difficult to calculate the material damage from this. In addition, by the time the company blocked the link, we had already paid for notary services and legal advice.
Litigation requires additional financial costs and lasts a long time, so always try to negotiate compensation for your damage peacefully, you may be able to compensate for some of your losses. We also tried to do this and wrote a letter to the PL. In our cases, there was no constructive dialogue: the company wrote that they did not intend to protect the spammer (i.e., their official representative, Ivan Bochenkov), this is completely his responsibility and we must make all claims personally to him, and they will not specify who spammer
And at this time, the spammer continues to defend the honor of the company, threatens us in correspondence by email, writes letters on our behalf to customers using profanity.
Step 5. Gather additional information.
Most likely, your mailing case is not the only one and the person who has been doing this has already offended someone before you. Collect this information, people often write in open sources about such incidents. They will be able not only to characterize your personality, in our case, the “spammer”, but they will surely know his contact and other data.
Ivan Bochenkov turned out to be no exception, we found freelancers on the network, whom he did not pay for work, threatened spam with newsletters through their contacts about what they were “losers”, insulted with obscene expressions and so on. In general, he did everything the same thing that our spammer did and does.
One of the freelancers lost his official job as he decided to demand payment for the work done from Ivan. In his words, Ivan talked to his supervisor, and the next day the freelancer was fired without explanation.
Fig. 13 Post in social. Nets about designer cheating
Fig. 14. Feedback on Ivan in the list of customers who do not pay orders
vk.com/photo-51016572_370984336
Fig. 15. The manner of communication Ivan. An excerpt from the correspondence with one of the freelancers whom Ivan did not pay, however, from the words of the freelancer himself, used his works.
Each story of interactions with freelancers is a separate story that requires a separate investigation, but we can conclude for ourselves that if such stories happen, it’s not just that they give a certain characteristic to a person by the very fact of their existence.
Step 6. Send the information you have to the competent authorities and write a statement
Now that you have gathered all the information and facts about the incident that occurred, when you have feedback describing the participants, transfer all your data to the competent authorities. They will establish the fact of possible fraud in your address.
If this article was useful to you, then how to apply, in what instances and what happens next, we will write in the next section.
Lesson 4. As Warren Buffett said: “It takes 20 years to build a reputation, and 5 minutes to destroy it” and do not trust the development of your project to doubtful people.
Ps.: While we were writing this news, Ivan became active again and now sends spam in the interests of Sipuni.com - but this is another story.
Source: https://habr.com/ru/post/295804/
All Articles