I created a tool that automatically follows ads to try to find scams.
But that was usually reserved to typosquat domain ads or ads on porn websites.
I didn't know scammers used normal page ads too.
I know tech support scams used to use google search ads, but I don't think they do that as much anymore, so maybe they have moved onto things like adsense.
These scammers usually do IP address checks to check for residential IP before showing the scam, and some also do some basic fingerprinting checks, so that is how they get past detection. That said, it shouldn't be too difficult for google to do some better checks if they actually cared.
Yep. I Agree. I believe it's a question of economics, not technical challenges.
Google is absolutely smart enough to make these attacks un-economical. IMO they are unwilling to incur the loss in revenue this would involve (false positives, banned resellers etc).
Another major issue is google safe browsing whitelists many of these subdomains that the attackers like to host their scam pages on.
As a result, even though "Enhanced" safe browsing can use Gemini Nano to do client side detection of scams and then flag it in google safe browsing for everyone, the entire domain and all subdomains are whitelisted, so that detection never seems to actually fire.
https://blog.google/security/using-ai-to-stop-tech-support-s...
I'm not sure which domains this applies to, but it seems to apply to most of the domains that these scammers actually like to use.
> These scammers usually do IP address checks to check for residential IP before showing the scam, and some also do some basic fingerprinting checks, so that is how they get past detection.
Same issue with spam sms in my country: I think they geo-locate it so submitting the link to safe browsing project takes way too long
I don’t understand this being a “national security” threat.
Besides, mobile proxies exist which work differently. All you need is a mobile data plan that you run a proxy server on. It allows for easy IP rotation and since it’s a pool shared with other customers you cannot easily block it. This is because of things like CGNAT.
IP rotation is easy because reconnecting to the network gives you a new IP address.
Static residential proxies also are a thing, even if they are less effective sometimes.
Google has already been crippling the audio CAPTCHA access for many years. If your trust score is low enough, the visual challenge is ridiculously slow and noisy, and pressing the audio challenge button will just give you an error saying "To protect our users, we can't process your request right now", accessibility be damned. Where are the lawsuits? I want to believe there are still forces that would create hell to pay for doing something so evil, but I'm not seeing any.
Haven't you heard? Accessibility is woke, and the institutions that are supposed to protect it are being dismantled. I wouldn't be counting on those lawsuits going anywhere personally.
OP here. My university was targeted by a recent phishing attack, and these are my findings. I hope this helps others, but this was my first experience with an Adversary in the Middle (AitM) attack.
I created a tool that automatically follows ads to try to find scams.
But that was usually reserved to typosquat domain ads or ads on porn websites. I didn't know scammers used normal page ads too.
I know tech support scams used to use google search ads, but I don't think they do that as much anymore, so maybe they have moved onto things like adsense.
These scammers usually do IP address checks to check for residential IP before showing the scam, and some also do some basic fingerprinting checks, so that is how they get past detection. That said, it shouldn't be too difficult for google to do some better checks if they actually cared.
reply