Unlike in snail mail or e-mail, Facebook spam often depends on how smart — or hapless — your friends are.
One vexing example is a type of spam that offers to let one see “who’s been viewing your profile.” Facebook users typically see that offer displayed as a friend’s status update because that person clicked on a similar offer elsewhere. These messages appear in automatically generated status updates, small sidebar apps, or pages purporting to have the answer just a click away.
Trouble is, such a thing isn’t even possible, according to Facebook. That type of spam has become a significant problem the company says it is taking seriously. In general, it’s unclear exactly who posts spam on Facebook. Why they do is another matter. Almost always, it is in order to redirect users to a survey or other click-inducing gimmick. In other words, many spammers are in fact paid marketers.
MORE: Yahoo-Facebook: Brace for the countersuit
Facebook has won judgments against spammers in the past. In 2009, “Spam King” Sanford Wallace was ordered to pay Facebook $711 million for generating phony wall posts and messages. Facebook’s legal team posted about the decision and advised users to report spam. In 2010, Adam Guerbuez of Quebec was ordered to pay $873 million after sending users messages about erectile dysfunction medications. But “who’s viewed your profile” spam is different. Instead of being direct and personal, it tantalizes users to click on something by choice.
Who’s behind such spam and why? By intentionally clicking scores of this material, Fortune found that much of it leads to one place: fast2earn.com. The firm is not likely the only such outfit, but it appears to be prolific. It lures users with sites made to look like legitimate Facebook Pages, such as one dubbed “Facebook – Who’s viewed me.” The page has three tabs: “Income from your web page,” “Receive cash from your website” and “Tramadol.” (Tramadol is a real medication for treating joint pain; that tab contains nothing.) The page promises to “turn your valuable webpage visitors into revenue. Work online and join our free money-making affiliate program.” Clicking on any link redirects to another nondescript page asking for a name and email. Doing that leads tofast2earn.com.
To join, the site asks only for an email, password, and first and last name. Doing so leads to a “New Affiliate Signup” page. It reads: “Dear [NAME], Thank you for registering with fast2earn.com. In a short time you have to receive a confirmation email with the same information. Make your new business happy and rich!” At the top, there is a running counter of the money you’ve earned and an “affiliate link” that leads to fast2earn.com’s own signup page. In other words, they’re paying you not only to promote links from various companies involved, but also to get others to join fast2earn itself and do the same trolling. An FAQ page instructs users on how to create a page, using Blogger.com or Weebly.com, to promote marketing links.
MORE: At Facebook, hackathons for advertisers too
Fast2Earn did not have any phone number or corporate contact info listed. But the web site PTC Investigations, which looks into so-called pay-to-click services, posted about Fast2Earn as recently as February (their verdict: “not recommended”). In the “Summary” section, PTC Investigations notes: “I wouldn’t place any ads from fast2earn… From what I have read is that once people get close to cashout the site stops counting visits and then people can’t cashout.” There are many pages of generic praise for the service, though a number of posts complain explicitly about the site. “It’s a scam, you get to $50 and they stop counting views as unique,” posted a forum user named Caesar.
Weebly wasn’t please to hear that fast2earn instructs its users to disseminate spam via Weebly pages. “We fight this really hard,” says CEO David Rusenko, who adds that Weebly operates 10 million web pages, only 1% of them junky in nature. (Facebook, meanwhile, says 4% of its content is spam; still quite low.) “With so much volume,” Rusenko says, “you’re going to see some spammy things that just kind of got through our filters, but we’re vehemently against that and we think we do a great job of identifying it.” Regarding fast2earn specifically, he says, “One of our spam guys got really angry” when the site was brought to their attention.
In addition to Pages that turn out to be built by real marketing companies, there are others that appear to be empty or lead nowhere. “See Who Viewed your Profile” is one such example of a legitimate-looking Page, on Facebook, that contains only the line “Like this page to see Who Viewed your Profile!” repeated three times. A description of the Page reads: “Genuine and Working Application.” (A good sign that it is anything but.) Clicking “like” redirected us to a completely new Page: “How will you die?” It commanded the same action: “Click Like for content.” Click like, and all that it reveals is the Page’s wall, which is empty except for one post providing the date that “How will you die” joined Facebook (a milestone that ought to go uncelebrated).
MORE: How to get a job at Facebook
Internally, Facebook employees call these “like-jacking” scams. There are typically two types. One takes the user to a page off of Facebook where there’s a like button buried, often made opaque or hidden under an image. The second type is more straightforward and exists as a real page on Facebook that asks users to click like in order to get the functionality it’s promising. Facebook calls that second type “manual like-jacking,” since there’s no trickery in the design, it simply relies on the user’s gullibility. When the spam Pages don’t lead anywhere, Facebook says that’s a good indication it has already caught them, because its first focus is always to cut off the dangerous places such pages lead.
It takes the company longer to remove all the tendrils of a given piece of spam, though. “We’ve built enforcement mechanisms to quickly shut down malicious Pages, accounts and applications that attempt to spread spam by deceiving users or by exploiting several well-known browser vulnerabilities,” said Facebook in a statement. “We’ve got content in our Help Center,” says Facebook spokesperson Fred Wolens, “that says there’s no way to see who’s been looking at your profile, there’s not that functionality, we haven’t built it and no one else can build it.”
For more, buy the exclusive Inside Facebook story from Amazon here or from Barnes & Noble here. You can also read it with the iPad app for free if you are a Fortune subscriber.
[cnnmoney-video vid=/video/technology/2012/02/28/ts_3_things_facebook.fortune]
