Amazon, Amazon Music, and Audible, an Amazon-owned on-line audiobook and podcast service, have been flooded with bogus listings that push doubtful “foreign currency trading” websites, Telegram channels, and suspicious hyperlinks claiming to supply pirated software program.
Amazon listings promote illicit websites
Yesterday, BleepingComputer reported how menace actors had been abusing Spotify playlists and podcasts to promote pirated software program and recreation cheats.
The playlist names, podcast descriptions, and bogus “episodes” in these listings urged listeners to go to exterior hyperlinks to doubtful web sites.
We have now now come throughout a number of listings on Amazon’s web sites together with amazon.com, amazon.co.uk, amazon.com.au, and Amazon Music that promote doubtful “foreign currency trading” schemes and hyperlink to “warez” websites.
Spammers are moreover abusing Audible podcasts as one other vector to advertise their illicit operations.
No digital platform that is open to all is immune from being spammed. What makes circumstances involving Spotify or Amazon peculiarly fascinating is, one would instinctively anticipate the overhead related to podcast and digital music distribution to discourage spammers who’d in any other case depend on low hanging fruits, reminiscent of writing spammy social media posts or importing YouTube movies with tainted descriptions.
An Amazon Music (Colombia) itemizing under which seems in Google search outcomes for “obtain bookmap… remaining full crack” is proven under:
(BleepingComputer)
Equally, Amazon web sites together with amazon.com and .com.au had been caught serving listings for “bot buying and selling software program” laden with exterior hyperlinks.
BleepingComputer noticed the size of the audio “episodes” printed underneath these “podcasts” was zero seconds. As such, these listings served no goal aside from flooding Amazon’s digital properties in an try to spice up the search engine rating for spammy domains, a method known as website positioning poisoning.
BleepingComputer reached out to Amazon and Audible with our questions and shared one of many instance listings with Amazon nicely upfront of publishing.
Amazon eliminated the instance itemizing throughout its web sites however didn’t reply to our questions.
‘Buying and selling’ marketplaces and Telegram channels
A typical development we noticed amongst many such listings was the point out of a doubtful “buying and selling platform” known as EliteMarketMovers.
Some listings ship customers off to the Telegram and YouTube channels of this “market.”
Whereas the “EliteMarketMovers.com” area now not responds resulting from a possible server misconfiguration, we peeked into the archived copies of the web site:
The web site claims to supply a number of “buying and selling pairs” and “prime foreign exchange robotic” merchandise, however there’s little indication or assurance that these are genuine choices or that the platform is a licensed and controlled entity in your jurisdiction.
Spam an ongoing drawback for podcast distribution providers
As we explored yesterday, like a number of Spotify “podcasts”, these listings are additionally abusing third-party podcast publication and distribution providers to push their bogus merchandise on excessive rating web sites like Amazon.
BleepingComputer seen an similar “Powered by Firstory” banner on these listings, implying the “podcast” producers are abusing Firstory to advertise their operations throughout Amazon, Spotify, and different streaming platforms:
Launched in 2019, Firstory is a web based service designed to “empower podcasters on the planet to distribute in all places and begin to join with audiences!”
One can use Firstory to publish podcasts on Spotify, however the platform acknowledges that spam is an ongoing drawback that it’s specializing in curbing.
“Spam accounts and content material are ongoing challenges, and it is one thing we proceed to concentrate on enhancing,” wrote Firstory co-founder Stanley Yu to BleepingComputer in response to our questions yesterday.
Anybody can use Firstory to publish podcasts to streaming platforms.
“Nonetheless, we do have sure filters in place to stop accounts utilizing particular fraudulent domains or electronic mail addresses containing variations reminiscent of account+[numbers]@gmail.com or ‘.’ in emails.”
“These spam accounts not solely violate the rights of the creators we worth most, however additionally they drive up our operational prices. We have devoted appreciable assets to addressing this concern,” states Yu.
Along with collaborating carefully with streaming platforms, Firstory continues to report infringing content material to platforms, make use of know-how to scan podcast titles and shownotes for particular spammy key phrases, and block suspicious electronic mail addresses utilized by menace actors to pollute these platforms.