Fake CAPTCHAs Funnel Users Into International SMS Revenue-Share Fraud
Summary
Researchers detail a campaign active since at least 2020 that uses fake CAPTCHAs and traffic-distribution systems to trick users into sending large batches of international SMS messages, generating revenue for the operators and unexpected charges for victims.
Key points
- The campaign has operated since at least June 2020 and uses fake CAPTCHA pages to disguise prompts to send SMS messages as human verification.
- Each verification step can prefill messages to numerous international numbers; one observed four-step flow could trigger 60 messages and cost a victim about $30.
- Researchers observed 35 numbers across 17 countries, including destinations with high SMS termination fees.
- Traffic-distribution systems route targeted visitors through multiple domains to the scam pages and can obscure them from researchers and automated detection.
- JavaScript interferes with browser history to trap users on CAPTCHA pages; the operation also uses cookies and user attributes to control traffic and redirect visitors.
- After the CAPTCHA, a gaming and video site can continue the scheme by prompting further SMS messages; allowing its push notifications may bring users back to the site.
- The fraud creates unexpected phone-bill charges for individuals and potential losses for carriers; researchers advise users not to send texts to prove they are human.
Article Details
- Attack Vectors
- Fake CAPTCHA pages prompt users to send repeated SMS messages to international numbers, generating revenue for the operators.
- Traffic distribution systems redirect visitors through multiple nodes to fake CAPTCHA pages and other scam content.
- JavaScript manipulates browser history with pushState() and redirects users who try to navigate back, trapping them on scam pages.
- The operation uses push notifications to encourage victims to return to scam sites or visit other scams; the article describes this use as likely.
- Defensive Notes
- Do not send a text message to confirm that you are human.
- Be cautious of fake CAPTCHA pages that ask you to send SMS messages; the resulting international charges may appear on a phone bill weeks later.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 4lifetips[.]com | Domain hosting older versions of the fake CAPTCHA or download pages. |
| DOMAIN | buffalosolpe[.]top | Domain pattern example identified as part of the fake CAPTCHA campaign. |
| DOMAIN | carrolvassin[.]top | Domain pattern example identified as part of the fake CAPTCHA campaign. |
| DOMAIN | chatorizon[.]com | Domain used in the campaign's fake video-content hostname. |
| DOMAIN | claimandwins[.]com | Domain hosting older versions of the fake CAPTCHA or download pages. |
| DOMAIN | colnsdital[.]com | TDS node in the redirect chain leading to the fake CAPTCHA page; attribution is listed as unknown. |
| DOMAIN | fufecarrol[.]top | Domain pattern example identified as part of the fake CAPTCHA campaign. |
| DOMAIN | matchnewtoday[.]com | Domain used in the campaign's fake chat-content hostname. |
| DOMAIN | megaplaylive[.]com | Actor-controlled landing domain used to continue the SMS scam through gaming and video content. |
| DOMAIN | panzozerrot[.]com | Domain pattern example identified as part of the fake CAPTCHA campaign. |
| DOMAIN | remotesbuffalo[.]top | Domain pattern example identified as part of the fake CAPTCHA campaign. |
| DOMAIN | transitcaxip[.]com | Domain pattern example identified as part of the fake CAPTCHA campaign. |
| DOMAIN | verifysuper[.]com | Domain hosting a fake CAPTCHA page used as an alternate offer. |
| DOMAIN | vistertransit[.]com | Domain pattern example identified as part of the fake CAPTCHA campaign. |
| DOMAIN | zawsterris[.]com | TDS domain controlled by the SMS scam actor. |
| DOMAIN | zerrotmamil[.]com | Domain pattern example identified as part of the fake CAPTCHA campaign. |
| HOSTNAME | chat[.]matchnewtoday[.]com | SMS actor-controlled domain hosting fake chat content. |
| HOSTNAME | d[.]fufecarrol[.]top | SMS actor-controlled hostname actively hosting fake CAPTCHA pages. |
| HOSTNAME | d[.]herbosfinx[.]com | SMS actor-controlled hostname used to host a fake CAPTCHA page. |
| HOSTNAME | d[.]marraheltin[.]com | SMS actor-controlled hostname actively hosting fake CAPTCHA pages; its cookie data is analyzed in the article. |
| HOSTNAME | d[.]panzozerrot[.]com | SMS actor-controlled hostname actively hosting fake CAPTCHA pages. |
| HOSTNAME | d[.]remotesbuffalo[.]top | SMS actor-controlled hostname actively hosting fake CAPTCHA pages. |
| HOSTNAME | d[.]ruelomamuy[.]com | SMS actor-controlled fake CAPTCHA host and API endpoint used to retrieve phone numbers and redirect information. |
| HOSTNAME | d[.]santafebuno[.]top | Fake CAPTCHA hostname used as a redirect destination when a victim attempted to navigate back. |
| HOSTNAME | d[.]vistertransit[.]com | SMS actor-controlled hostname actively hosting fake CAPTCHA pages. |
| HOSTNAME | d[.]zerrotmamil[.]com | SMS actor-controlled hostname actively hosting fake CAPTCHA pages. |
| HOSTNAME | hotnow[.]sweeffg[.]online | Commercial TDS hostname in the redirect chain; the authors attribute it with high confidence to a commercial affiliate advertising network. |
| HOSTNAME | r[.]buffalosolpe[.]top | SMS actor-controlled hostname actively hosting fake CAPTCHA pages. |
| HOSTNAME | r[.]carrolvassin[.]top | SMS actor-controlled hostname actively hosting fake CAPTCHA pages. |
| HOSTNAME | r[.]transitcaxip[.]com | SMS actor-controlled hostname actively hosting fake CAPTCHA pages. |
| HOSTNAME | vids[.]chatorizon[.]com | SMS actor-controlled domain hosting fake video content. |
| URL | hxxp[:]//megaplaylive[.]com/?enc=eyJwaG9uZU51bWJlcnMiOlsiKzIwMTAwNTc5NzQ1MiIsIisyMDEwMDQ5MzkxNzgiLCIrMjAxMDA1Nzk2Mzg5IiwiKzIwMTAwNDk1MTYyNiIsIisyMDEwMDU4MDMzNzkiLCIrMjAxMDA2MzQ4ODc5IiwiKzIwMTAwNDkzOTE0NSIsIisyMDEwMDUyMDk2NzYiLCIrMjAxMDA2MzQzOTk3IiwiKzIwMTAwNjM1MzY5MyIsIisyMDEwMDk0MDg1ODQiLCIrMjAxMDA1Nzk2Mzk5IiwiKzM4MDkyNzg4NTQ2MiIsIiszODA5MjI0MTg0MDQiLCIrNDQ3NDkwOTIwODEwIiwiKzQ2NzY2NzQ2NDUxIiwiKzQzNjcwMzA2ODEwNyIsIis3NzkwNTAwMDIyNSIsIiszMjQ2NzQ0MDQyNyIsIis0NDc4NDg1MDk0NDgiXSwiYWYiOiI1MDAyMzIwNjQ5MzQ0ODQ5IiwiZGV2IjpudWxsLCJ0eXBlIjoiZ2FtZXMiLCJsYW5nIjoiZW4iLCJsb2FkZXIiOmZhbHNlLCJjaWQiOm51bGwsInBpZCI6bnVsbH0= | Specific redirect destination on the actor-controlled domain, carrying encoded scam phone-number and campaign data. |
| URL | hxxps[:]//d[.]ruelomamuy[.]com/makeTrackerDownload[.]php?a=WEBSMS&s=5002320649344849&c=US&groupds=138&caf=5002320649344849&origSms=I%20want%20to%20continue%205002320649344849&step=9 | Example API URL on the fake CAPTCHA host used to retrieve scam phone numbers and redirect data. |
| URL | hxxps[:]//verifysuper[.]com/cl/i/wopmej?aff_sub4=5002320649344849&aff_sub5=US | Alternate fake CAPTCHA URL identified as an externOffer destination. |
People
Vendors
Adam Ecotechthrough DNS: before hiding behind Cloudflare, zawsterris[.]com briefly resolved to an IP on AS15699 (Adam Ecotech), which is the same infrastructure we’d already linked to this SMS fraud campaign.CloudflareThe most notable one came through DNS: before hiding behind Cloudflare, zawsterris[.]com briefly resolved to an IP on AS15699 (Adam Ecotech), which is the same infrastructure we’d already linked to this SMS fraudDigiCertDomains are registered using NameSilo or GoDaddy and use DNS Made Easy (DME) and DigiCert nameservers.Digital OceanDigital OceanDNS Made EasyDomains are registered using NameSilo or GoDaddy and use DNS Made Easy (DME) and DigiCert nameservers.GoDaddyGoDaddyHetznerHetznerInternapInternapMedia EliteMedia EliteNameSiloNamesilo
Tools
Countries
AustriaAustriaAzerbaijanDuring our research, we observed the use of 35 phone numbers spanning 17 countries, including those known to have high termination fees, such as Azerbaijan, Egypt, and Myanmar.BelgiumBelgiumEgyptDuring our research, we observed the use of 35 phone numbers spanning 17 countries, including those known to have high termination fees, such as Azerbaijan, Egypt, and Myanmar.FranceFranceGermanyhigh degree of confidence to a commercial TDS that is part of an affiliate advertising network based in Germany.ItalyItalyKazakhstanregister phone numbers in countries with high termination fees or lax regulations, like Azerbaijan, Kazakhstan, or certain premium-rate number ranges in Europe; and establish revenue-sharing agreements with localMalawiMalawiMyanmarDuring our research, we observed the use of 35 phone numbers spanning 17 countries, including those known to have high termination fees, such as Azerbaijan, Egypt, and Myanmar.Netherlandscountries, including many locations known for having higher than average termination fees, such as the Netherlands, Myanmar, and Azerbaijan.PolandPolandSpainSpainSwedenSwedenSwitzerlandSwitzerlandTurkeyTurkeyUkraineUkraineUnited KingdomUKUnited StatesOver a year ago, we encountered a website employing an unusual technique for distinguishing humans from bot traffic: it required us to send SMS messages to proceed.