Looking at the Large Scam Campaign on pages.dev

April 04, 2024

Originally posted on CheckPhish Community

Introduction

Recently, scanner.ducks.party identified a significant number of URLs on the pages.dev domain that were part of a large-scale fraudulent campaign. Of the 36,003 URLs, 22,449 are still active and involved in fraudulent activities.

The Content of the Scam

The URLs in question are designed to appear as legitimate news or finance sites. However, their primary purpose is to lure unsuspecting visitors into a web of deception and extract personal information or money. The content of these scam sites is meticulously crafted to appeal to the desires and fears of the visitors. Here are some of the common themes and tactics used:

• Work-from-home opportunities: Many of the sites promote work-from-home jobs, often promising significant income for minimal effort. They use testimonials from supposedly successful individuals to lure visitors into signing up for these 'opportunities'. However, these jobs either do not exist or require the user to pay a hefty fee to access them.
• Financial success stories: The sites often feature stories of individuals who have achieved financial success through a specific program or system. These stories are designed to resonate with the visitors, playing on their desires for financial freedom and security. However, they are largely fabricated, using stock images and changed names to protect the identity of the individuals involved.
• Sense of urgency: The scam sites often use a sense of urgency to pressure visitors into making a decision. For instance, they may display a warning that the registration deadline for a program is fast approaching or that there are limited spots available. This tactic is used to prevent visitors from thoroughly researching the program or opportunity before committing to it.
• Misleading links: The sites are filled with numerous links to reputable sites like Google, Bing, Yahoo, Facebook, YouTube, and Twitter. These links are strategically placed to give the illusion of credibility and authenticity. However, they serve no purpose other than to deceive the visitor.

List of Scam Sites

To aid in the takedown of these deceptive links, I have compiled a list of the 22,449 active URLs on the pages.dev domain that are part of the scam campaign - link.

I encourage everyone to report these URLs to the relevant authorities and to share this list with others to raise awareness about the scam campaign.