New scam targeting web publishers

Web publishers need to keep their eyes peeled for a new scam from fake networks / exchanges abusing the name of established players.

Scam ad networks are not a new thing. Forums are full of “new networks” appearing that promise great CPMs to publishers who sign with them, followed by posts from irate publishers complaining that they never got paid and the network was uncontactable. Such networks come and go quickly, but are usually not too hard to spot. Lack of contact details (or fake contact details), poorly written websites and few mentions online usually give them away quite quickly.

One keen eyed publisher forwarded us a mail showing a variation on this scam. Rather than faking a new ad network the scammers simply pretend to be someone else. This is far more nefarious, not only because it is bringing the name of a good company into disrepute, but because it is far more likely to catch out unsuspecting publishers.

Here is how the scam works:

The scammers register a similar domain to a well-established player. They reach out to publishers with the promise of premium campaigns and play off the reputation of the innocent network to persuade publishers to sign. The publisher then run the tags, the scammers pocket the money and disappear when the publisher starts chasing payment.

This can be a double hit for publishers as they not only lose money, but are trafficking ads that are potentially unsafe to their users.

An example of the outreach emails:

Here’s an example of an outreach email that one of our publishers was very suspicious of. The email purports to be from Casale Media (The previous name of Index Exchange).  Please note that Casale / Index Exchange are a legitimate player and innocent here. It certainly looks like a fake email to us, and we’ve been told that Casale don’t use any Casale Media domains in their outreach any more. It is their reputation that is being exploited. This scam could just as easily be replicated using any other demand source (and probably is right now).

Here is the email we were shown, decide for yourself:

Whilst the email itself seems legitimate, the domain being used is rather suspect. The extension is .com.co , which leads to a newly registered site with little information and hidden whois information. The email comes from the same domain, so the email is unlikely to have come from the real Casale Media.  Searching around the web it seems that several similar domains have been used for this scam in the recent past (some more examples here)

 

It’s essentially a very targeted phishing scam and one that seems to be picking up a few victims.