How Megaphone burned on mobile subscriptions

For a long time, funny jokes have been told about paid mobile subscriptions to IoT devices.


With Picabu

Everyone understands that these subscriptions are not complete without the actions of mobile operators.

But mobile operators insist that these are suckers:
')

original

For many years, I have never picked up this infection, and even thought that people get this way because of their computer illiteracy. But I was wrong ...

Recently, having shared the Internet from Megaphone, I sat and quietly worked at the computer until a redirect occurred in Google when clicking on the next link



and I opened this window



Of course, I overcame professional interest.

I immediately realized that this is it! The very thing that people write about so often, and now they will try to dissolve me for money.


But it says nothing about paid subscriptions ...

Since I have 0 rubles on my phone’s account and there are no “credits of trust”, I clicked the “Continue” button.

There was a redirect to another page. The design is very similar to the first



An ordinary person will not focus on this and will think that the contents remain the same.
But the gray, barely noticeable text is completely different:

By clicking on the "Continue" button you confirm your agreement with the connection to the vsewap.ru subscription and the Subscription Terms. Subscription price 35.0 rub. including VAT for 1 day. Payment is made from the main account. The service is provided by the content provider OOO Informpartner.

I continue the experiment and press "Continue". SMS arrives ...


Subscribed! Of course, I immediately turned it off.

As most people think in such cases, I probably have a virus on my computer and he redirects me to the site of the content provider.

But in this case it is the Megaphone that makes the redirect using the same technology that redirects you in case of any Internet restrictions or wap-click is used. Unfortunately, I can’t say more precisely.



Such redirects are faced by corporate users:

I am looking for a place where the "legs" grow:

I check who owns the domain, the site on which he wants to "dissolve":



How unexpected! Domain belongs to Megaphone!
And such a coincidence that the web server's ip also belongs to Megaphone

nslookup truvpro.ru
Name: truvpro.ru
Address: 31.173.34.227
Name: truvpro.ru
Address: 31.173.34.226

inetnum:        31.173.32.0 - 31.173.39.255
netname:        MF-MOSCOW-BBA-POOL-31-173-32
descr:          Moscow Branch of OJSC MegaFon
role:           Moscow Branch of PJSC <b>MegaFon Internet Center</b>

, - .

, - moy-m-portal.ru


, Citrix Netscaler, , , ID .
:

dnslytics.com/reverse-ip/31.173.34.226
dnslytics.com/reverse-ip/31.173.34.227

- …

2019 («created: 2019-03-20»)

, Google Chrome , :



, , !

, ( Kate Mobile) , ip IP. …

, ( , : moy-m-portal.ru ). , .


:

1. REG.RU
2. -
3. . . ( ).

vk-vid.com/site/offer

, ! ?..

…

. - , , .

-, ! , , 159 . «» ! .

—



, .

, -…

200 000 35 . 100 000 . 3,5 …

— Megafon. , , ( YotaRussia ).

, «»




, , ?

P.S.: : .