PUBLIC SERVICE ANNOUNCEMENT - A new low in Faceache scams

lozkerr · 2025-10-07T10:27:16Z

I received a couple of these in the run-up to our last gig and thought no more of it - they were trapped as spam and a quick look through the source code uncovered quite a few red flags. I thought it might have been a one-off, but I've had another one today from some more supposedly big-shot US lawyers. This one's a bit cruder than the earlier supposed missive I had from Cravaith, Swaine and Moore, but it's still a scam.

It's a nasty one, though. For one thing, both those companies really exist and they genuinely are large legal firms. Everything apart from the alleged 'infringing video' link resolves to real URLs and email addresses. I've been on the Internet for 37 years now and thought I was wise to this sort of crap but it still gave me a jolt.

It is designed to do one thing and one thing only - panic the recipient into clicking that supposed Facebook link. It looks like it's been shortened just to fit nicely on the page, but in this case it really has been shortened. Here's what it looks like under the bonnet:

Infringing Link: <a style="color:#0b5b7a;text-decoration:none">https://www.facebook.com/108692607419559/videos/...</a>

In this case, it's dead - clumsy work on the scammer's part - but in the earlier one, it led to a shortened URL. Hovering over it displayed the actual link - bit.ly/something_or_other. Expanding the shortened URL - you can find plenty of sites that will do that for you - showed it led to a page stating that 'Unexpected traffic has been detected from your computer' with a link to click.

Click on that link and you'll be asked to log into 'Facebook' - it's actually a fake login page. If you take the bait, bam - these scumbags have your login credentials.

And just to add insult to injury, Faceache took the post down and restricted my account when I uploaded these annotated screenshots.

Let's be careful out there!