The Price of FREE! | Malwarebytes Labs

We all like FREE! stuff. But for most of us, we don’t just go for anything and everything that has a zero price tag. We also look at how a product or service can be useful for us, as well.

Online, FREE! thrives.

Social networking sites, certain blogging platforms, and several digital retailers,such as Amazon for their free e-books, provide access and opportunities for users to learn, to reach out and express themselves fully in words and pictures, and to share experiences with someone or the rest of the world.

But according to one famous economic adage, all things FREE! may not be free, after all.

We encountered a number of legitimate domains that have become unlikely launchpads to spammy content. Apparently, the groups and/or individuals behind these have moved away from Blogger and used as many variety of free services online as they can. Here are the domains the we found:

Ticketbud. This is an online ticketing and ticket management service aimed at events organizers. Although it usually requires users to pay, organizers of free events can create free accounts. Below are screenshots of sample pages we have gathered:

Goodsie. This is a paid service for easy website building that caters to US-based retailers who want to establish their presence on the Web; however, it offers a 30-day free trial period, something that proponents of spammy content didn’t resist to take. Screenshots below:

Other similarly affected site builders are JouwWeb (based in the Netherlands) and PagineLibre (based in Italy).

Soup. This site is more of Tumblr than Twitter in terms of the microblogging service it offers. The Guardian hailed it once as one of the most essential blogging websites. Below are samples of spammy content found in it:

FruitNotes. If at some point you were looking for note-taking programs online, you might have stumbled upon FruitNotes. It’s a simple, no-frills tool that allows users to record their voices via phone and share it with others. It also has a free blogging service. Thankfully, one can easily visit a page to see the latest blog posts from users, and this is what it looks like:

click to enlarge

Most of the content we have observed are similar across all domains we mentioned. Most of the sites themselves are also popular and visible to the public.

As we already know, the more visible a site it, the higher the probability that someone somewhere would click a link from these spammy pages and be directed to a third-party site that may not be safe. It’s best to avoid visiting such pages and report them to the domain owner.

Note: We have already sent out emails to the addresses related to these sites but have yet to receive a response. We’ll update this post once we hear from them.