Imposing an MT Subscription

    An unpleasant situation just happened.

    My wife posted a resume on several sites. Periodically comes and updates.
    Literally 15-20 minutes ago, an unknown girl called from the number (7 499 704 16 31). Further dialogue:

    Girl (D) : Good afternoon. Your resume is posted on one of our sites. The site does not work automatically renew publication. And in order to extend it for free, I will now send you an SMS with a code, and then I will call you back and you will inform me of it.
    Wife (F) : On which site?
    D : I can’t tell you, because we serve many sites.
    J : Ok, send it.


    At this time I was there, I immediately realized that this was a divorce.
    After receiving SMS, all fears were confirmed. In SMS there was a code, website address and telephone of a free support line.
    Site Address: www.RJob.tk . (46.182.24.228) Doesn't work anymore. Most likely the abuser worked for the registrar.
    The domain is clearly tied to the affiliate program.
    The IP address seems to be from Selectel.
    By 46.182.24.228 , the authorization form opens. It does not already open. Most likely, Selectel worked. Well done.

    The site below has subscription terms. Although it doesn’t matter.
    Everything works through InkorMedia (numbers). Support Number 8-800-5555-638.

    A few minutes after receiving the SMS, the girl called back.
    D : Report the received code.
    F: Please, introduce yourself.
    D : Victoria
    J : What is the name of your company?
    D : Media.
    J : Girl, we checked the site from SMS, looked at all the conditions. You are trying to sign me up for an mt subscription without my consent. All data about you will be transferred to the content provider.
    D : Well, you don’t want to - as you want.

    They called in the media. From a conversation with the call-center operator, since we didn’t pass the code, we don’t need to worry, and the fact that they impudently impose the service on them is indifferent.

    Now I’m trying to find out which of the affiliates this domain is tied to. I will unsubscribe later.

    PS I honestly did not search on the hub for such schemes of fraud, perhaps already written earlier.
    PSS Many are being scammed for this way. So be careful yourself and warn loved ones.
    PSSS CVs were posted on HH.ru, SuperJob.ru, and the regional website 59.ru.
    It turned out that some acquaintances were also called some time after the CV was posted.

    UP : found out billing, described the essence. They will understand.
    UP2 : now fraudulent sites in the
    UP3 clouds : the billing was not the same, but this site previously worked through them and was blocked. We are looking further.

    UP4 : Another alternative to divorce: habrahabr.ru/blogs/infosecurity/134358/#comment_4460619

    UP5 : Pocket-filling started :) Someone doesn't like what is written about.
    UP6: Good note habrahabr.ru/blogs/infosecurity/134358/#comment_4461017
    UP7 : I wrote to the domain registrar.
    According to this scheme, scammers can work with any topic of ads. For example, real estate, cars, etc. So be careful and careful.
    UP8 : The site no longer opens.
    UP9 : It also does not open by ip, most likely it worked in Selectel.

    Also popular now: