Unfortunately, there has been quite a large increase in music scams in the last few years. Especially with the advent of Tik Tok and Instagram. Most people are able to sniff out these sorts of bad offers, however, if you are new to the industry, simple naiveness can make people fall for these scams, and with music rights, this can have a lasting impact on your reputation and copyrights.
Probably the most common one we see on a weekly basis is Instagram impersonation scams. You will have a well-known local organizer, label, or nightclub who will be throwing an event or contest. The most common we see are ticket and merch giveaways. The scammer will create a profile that pretty much matches the profile of the real account but with noticeable differences.
As we can see from the above two photos, both these accounts look similar, the one on the right could pass off to possibly be a new account from White Rabbit but notice the differences.
The biggest one here is obviously no posts and the large imbalance in the amount of followed accounts, to followers themselves. Use common sense, as some new artist accounts can look like this, but an established event company should have way more followers than this. This can be tricky however as followers can be purchased. If ever unsure, take a look at the type of accounts following the account in question. Are they all brand new with no followers and no posts? then they are probably a bot.
These accounts often will start off by following you and waiting a while. You will then often get sent an out-of-the-blue DM saying you have won free tickets, merch, or some other prize, and will have a link to click.
Under NO circumstances should you click the link. While it may seem harmless, and you might be curious as to what it is, mobile phone viruses have become commonplace. These links will have a browser hijacker or will lead you to a phishing page asking for information. We have clicked the link in the following image in a sandboxed environment, do not actually do this.
The problem, however, is often legitimate artists will also use a link-shortening service to promote their music or events. This allows the artist to track the demographics and how many clicks they actually get. Linkfire is a good example of this and something Record Workz Studios uses regularly.
A good way to check a link if you are unsure Is to check the link on the website VirusTotal.com This is a service that scans files and suspicious links for viruses, and even possible phishing detection
Taking a look at the above link in Virus Total, we get the following message.
We can see in the above photo it’s showing suspicious, but nothing really jumps out, it’s not until you actually go to the website that you can see that it is a social engineering page. Again, DO NOT go to any suspect links, this is simply to show what happens.
In the above photo, we can see the website is hosted with Weebly, and is not actually using the right domain name, It is using a .weebly address. If you have ended up clicking on a link, look for clues such as this. No professional company would host a website with a free domain name.
The real kicker is the Register Now button. Right-clicking this and hitting “copy link location” gives us an idea of where that button actually goes.
And boom.
We can see that the register now button goes to a spear phishing command and control server.
These types of social engineering attacks are unfortunately becoming more common and can take many forms. This can include “promo” websites and schemes that use bots to falsely drive up your numbers, or even fake publishing agents that can trick you into handing over your publishing rights.
In conclusion, trust your gut, do not click on random links, and if ever unsure contact the business in question by direct email asking to confirm. In this example, we messaged the real White Rabbit Group And straight up asked if there was a contest, and they confirmed this was a scam.
Stay safe everyone!