A global scam network used fake reviews to lure customers. Here’s how you can investigate them

Welcome to Indicator! You received this email because you signed up on our website or because you’re a subscriber to Digital Investigations by Craig Silverman or to Faked Up from Alexios Mantzarlis. Indicator is our new, merged newsletter and website dedicated to exposing digital deception. Read more about Indicator here and go here to upgrade to a paid member.

Today’s edition combines the two things Indicator was created to do: expose digital deception and share knowledge about how to do it. We have a scoop about a global scam network we’ve been tracking, and we’re using its operations as a case study to show you how to investigate fake online reviews.

Melinda Will wanted to write a book about her personal story of trauma, abuse, and recovery.

“I am a survivor of childhood abuse and I was in foster care and I aged out and got involved in a domestic violence relationship,” she told me. “I spent a lot of time healing and then building up my business and really just building up my life.”

She searched online for a company that could help her write and publish a book in order to help people aging out of foster care. “I’m not a writer,” said Will, who runs an accounting firm in California.

In November 2023, Will hired Majestic Ghostwriting. “I looked at a lot of different places before choosing them. The reviews were great,” she said.

Will paid $1,300 for writing services. Unhappy with the quality of work, she paid another $10,000 for a better writer. Then Majestic proposed a $94,300 marketing plan that included reviews, press mentions, social media promotion and other services. She agreed. But Will said the company failed to deliver what was promised, and it balked at giving the full refund outlined in their contract.

Will filed a civil suit last month against a group of companies and people associated with Majestic, alleging fraud, breach of contract, and negligent misrepresentation. She’s seeking at least $180,000 in damages.

Majestic gives the impression of a well-established business. It has positive customer reviews across different platforms, an active presence on social media, and a professional-looking website that’s been promoted using Google ads. But it’s all part of a digital smokescreen created by people and entities linked to a notorious Pakistani company.

Payment receipts, ownership records and online information connect Majestic to Intersys, a Karachi-based tech company, and its owner Azneem Bilwani. Intersys and Bilwani, as well as a group of related companies and people, were banned by the United States Patent and Trademark Office in 2022 for running a “widespread, intentional and coordinated effort to defraud both [trademark] applicants and the USPTO.” Intersys used to be called Abtach but it rebranded in the wake of the USPTO action.

Since then, the operation has expanded, purchasing at least thousands of Google ads for businesses offering services including book publishing and ghostwriting, Wikipedia page creation and editing, website and mobile app design, and trademark registration, records show. I’ve been investigating the operation with NatInfoSec, a pseudonymous security researcher. (They asked to withhold their name due to safety concerns.)

The network has left a trail of unhappy customers and multiple civil lawsuits in the US that claim fraud, breach of contract and other offenses related to ghostwriting and other services. 

Many of the victims are like Will. They had a deeply personal story to tell but felt they lacked the writing ability and publishing knowledge to do it on their own. The lawsuits detail how customers paid a small initial fee and were upsold services with promises of bestselling books and high profile media mentions that never materialized.

Book publishing and ghostwriting may not seem like a lucrative hustle, but earlier this year the Department of Justice indicted three people for allegedly running a book publishing scam that netted $44 million from over 800 victims.

Will said she’s still working to publish her book. But she has to do it by herself after giving so much money to Majestic. “I gave them basically everything that I had,” she said.

In late April, I sent Google a list of ad accounts that have promoted more than 100 Intersys-linked websites, including ghostwriting services and related schemes. Nate Funkhouser, a Google spokesperson, said the company had banned multiple ad accounts but didn’t specify which ones. He also revealed for the first time that Google has made a referral to the Department of Justice's Consumer Protection Branch over the network’s activity.

"We've taken action on policy violations tied to this issue, which included suspending advertiser accounts,” Funkhouser said. “As a part of this ongoing investigation, we also previously sent a referral to law enforcement about this matter."

It’s unclear where the referral to the Consumer Protection Branch stands, but the criminal division recently filed charges against a company in the Intersys/Bilwani sphere. Krebs on Security broke the news that a Bilwani company called eWorldTrade was recently charged with conspiring to distribute synthetic opioids in the US.

The DOJ did not respond to a request for comment. Nor did the lawyers representing eWorldTrade in its drug trafficking case. I also reached out to Majestic Ghostwriting, Intersys, Abtach and to related ghostwriting businesses operated by the network, but didn’t receive a response. As of today, eWorldTrade has not entered a plea in its criminal case.

Digital smokescreen

Will’s lawsuit said she hired Majestic thanks in part due to its “good reviews and convincing advertising.” Let’s focus on the first part: good reviews. 

The Intersys network appears to have made a concerted effort to generate fake reviews for its businesses and brands. After documenting suspicious reviews on their platforms, I shared a list of Intersys-linked websites with Trustpilot and Meta. 

Trustpilot removed 5-star reviews from Majestic’s profile but didn’t respond to a request for comment in time for publication. It’s unclear if the company will take additional action against the profiles and suspicious reviews I flagged.

Meta spokesperson Daniel Roberts said the company disabled the accounts I found that had placed fake reviews for Majestic and that it removed pages that violated its scam and spam policies. The Majestic Facebook page is still live as of this writing.

Fake reviews can be a great way to uncover a wider net of deception, as in this case. Let’s use Majestic as an example for how to investigate fake reviews and how to use them to connect businesses, websites and other assets together. 

Upgrade now to continue reading and to access my new, accompanying guide, “How to investigate online reviews.” 

You can save over 20% with our limited time launch discount. Get access to all Indicator content plus a monthly workshop where we do a deep dive on OSINT tools, techniques and other digital investigative approaches.

Subscribe to Indicator to read the rest.