Quick intro; skip if you don’t give a shit. <3
Been here for over a year, but I only started posting recently. I used to just call up Indian tech support scammers and yell “bhenchod” into the mic, but now that I have more time, I’m trying to get better at effective scambaiting (aka going for more wasted time more than quick laughs). I’m a hobbyist programmer, and also currently studying cybersecurity. I feel like social engineering isn’t really my strong suit, so my #1 goal right now is to waste >2 hours in 1 call, and if I ever reach that, I’ll try and reverse connect my way into a call center for the first time. So yeah, that’s what’s up for me on here.
Intro over, now to the reason you clicked here: I’ve posted 5 of the same exact popup with different phone numbers now, and literally 0 other posts, so I believe a proper tutorial is due. Also, I guess I don’t want to look like an “inside scammer” for finding the same exact type of popup 5 times and get banned. Here’s how I did it without an insider:
1. Disable any extensions that block scam sites OR pull up Incognito Mode (and disable blocking extensions if they’re allowed to run in Incognito)
I usually disable uBlock Origin, because it’s annoying to keep hitting “Allow (temporary)” on every popup that gets blocked. Better yet, if you feel up to it, do this stuff in an incognito tab. It’s not really something I’d recommend doing in a VM unless you have a beefy computer and there’s such little lag that it doesn’t justify the risk of a drive-by download. Incognito Mode also has the benefit of resetting cookies when you close and reopen the window, which can be useful for scam sites that ban you via cookies/localStorage rather than IP.
2. Pick a popular site people use a lot.
Don’t discriminate between sites “old people” use a lot. I have sometimes found fresh popups from Twitter, and old people don’t use Twitter nearly as much as those other sites you probably immediately thought of.
3. Screw with the URL a bit
Make common typos, like replacing Ls with Is or 1s, or replacing Os with 0s. Slightly less effective is the easier option of just inserting a random or duplicate letter. Also, one of my favorite strategies is to add a couple Ws before the domain, as if you forgot to press the dot after WWW, although that usually works better with 2 or 4 Ws for some reason.
4. Try the site
If it redirects you, keep trying it! If it redirects you to the same site over and over again, clear your cookies to make sure it’s not remembering you. If it remembers your IP instead of using client-side stuff, I wouldn’t recommend using a VPN. It’s not worth the time and usually gets filtered by DDoS protection. @terriblename said a pretty good tip in the replies: you can enable tethering on your phone with mobile data and get some easy legit-looking IPs on your computer, and if you search for these popups often, it’ll prevent you from being marked as spam as well. If it says the site can’t provide a secure connection, click on the address bar and change the https:// to http://. Often times, your router will warn you about scams and phishing sites via a man-in-the-middle type popup before visiting the site, and since it’s running MitM it screws with HTTPS, which was designed specifically to prevent your average “Starbucks WiFi” black hoodie Macbook script kiddies from doing that exact sort of thing with fake login screens.
5. Ignore One-Sided Scams
Many scams attempt to fool you into doing something without any way of wasting time for the creator. These are NOT what we’re looking for right now. If you have the time, report the sites to the hosts, but if I were to report every single “download this virus pls” page I’ve seen in the past week, I’d still be writing emails to this very moment. Reporting those pages isn’t really worth the time if you’re specifically searching for fake tech support, because of the sheer number of them and how easy it is to make a new one. If you find fake forms asking for contact info, you can fill it in to be put on some scammer’s contact list, and you’ll probably receive more spam to bait later, but those will rarely lead to human scammers (sometimes you’ll be asked to input antivirus info or whatever and THEN it’ll give you a number for “support” on your “next setup steps,” so actually read the page before closing it because “durrrrr form bad hahaha form = no phone number here, let’s move on guys.” Pages will often daisy chain scams together infinitely, sending you on to a different sponsored scam after you finish giving them your info, so if you are in a chain of 3+ different sites asking for your data, just give up. Forms leading to numbers is already kinda rare for this sort of scam, and chaining post-scam redirects together is usually something only survey “human verification” scammers do. TL;DR don’t download viruses thinking you’ll meet a human lmao. You’re here to waste THEIR time, not the other way around.
6. Post the number here, and have fun!
This tutorial assumes you already have a VM set up and are familiar with the actual scambaiting process, so I won’t explain any of that. All I ask of you is to contribute back to this forum, because often times the numbers I find here are down. That being said, MAKE SURE THE NUMBER YOU FOUND WORKS! On the bright side, if it’s down, that’s usually due to them not wanting to put up with our prank calls and shutting down the number. If you’re able to scambait and don’t have to do anything, it’s probably a good idea to wait for the scammers to “figure you out” first, so nobody calls them and warns them of prank callers. A lot of these clowns don’t even block you, and usually you get sent to a different scammer on your second call, so rain hell on their phone line until they finally take the time to block your number. As usual, I’m just gonna give a reminder that you SHOULDN’T USE YOUR REAL NUMBER. (probably posted here a million times, so I won’t explain why. do some research lol)
Ext
Being a programmer, I’m considering writing a script to automatically find scam sites. I’d make it replace/shift URL characters similar to how password crackers slightly change letters in guesses. Then, it would just get rid of all the 404 garbage, and you could look through em. It could also find the HTTP status code 302, 308, or whatever it’s called and show you each page that redirected, which is a good sign of a scam (or maybe the page just uses JS to redirect, in which case I’m kinda screwed) If you guys are interested, I could get started on it soon.
- Dex (aka Yuri)
