Category: Dead Internet Theory (DIT)

Dead Internet Theory (DIT) explores the idea that the open, human-driven web is being steadily replaced by automated content, algorithmic feeds, corporate platforms, abandoned websites, SEO spam, bots, and machine-generated noise.

This category investigates the evidence behind that idea without treating every claim as fact. We look at vanished communities, once-massive websites turned into digital ghost towns, bot networks, content farms, spam empires, dead links, abandoned forums, artificial engagement, platform consolidation, algorithm-driven culture, and the strange remains of the older internet.

Some of it is conspiracy theory. Some of it is ordinary technological change. And some of it is plainly visible to anyone who remembers what the web used to feel like.

These articles document the transformation of the internet from a sprawling collection of strange, independent places into something increasingly centralized, automated, commercialized, and difficult to distinguish from its own simulations.

Welcome to the archaeological layer of the modern web.

Posted on by

Unwanted social-account tagging to force notification delivery

Tagging is useful because it tells a person, this post involves you.

That promise is exactly what makes unrelated promotional tagging irritating.

On Facebook, tagging someone creates a link to that person’s profile and normally generates a notification. Depending on settings and the relationship between the people involved, tagged material may also interact with timeline-review and audience controls. See Facebook’s current explanation of how tagging works.

The feature was designed to connect a post with a relevant person.

Spam turns relevance into a pretext.

A tag purchases attention without buying an ad

Imagine a promotional post about cryptocurrency, clothing, a giveaway, or an event.

If the promoter simply publishes it, the platform decides who sees it through followers, recommendations, or paid distribution.

If the promoter tags fifty unrelated accounts, those accounts may receive direct notifications because the system assumes a social relationship exists between the post and the named people.

The tag becomes a tiny unauthorized delivery mechanism.

The same tactic can be performed manually, automated, or distributed across many accounts.

The important feature is not whether the post itself is commercial. A business can legitimately tag an employee, customer who agreed to be featured, event partner, or creator involved in a collaboration.

The problem is using identity references primarily to manufacture notifications for people who have nothing to do with the content.

Recipients become unpaid moderators of their own names

Unwanted tagging creates cleanup work.

The recipient has to inspect the notification, remove a tag, review timeline settings, block an account, or report repeated abuse. Platforms respond with privacy controls and review systems because a person’s name is otherwise a reusable attention handle.

That creates another Spam Empires pattern.

The spammer does not need to own the audience.

They only need a feature that can make the platform interrupt somebody on their behalf.

A legitimate tag says, you are part of this.

A spam tag says, I needed a reason to make your phone light up.

Posted on by

Browser push notifications turned into an advertising channel

A website used to disappear when you closed the tab.

Push notifications changed that.

Once a browser grants a site notification permission, the site can send alerts later even when the user is not actively reading the page. That makes notifications genuinely useful for chat messages, breaking news, deliveries, calendars, monitoring tools, and other time-sensitive events.

It also creates a durable advertising channel out of a single permission click.

Chrome’s current notification guidance reflects the abuse problem directly. Users can block sites from sending notifications, and Chrome may automatically remove notification permission from sites it considers disruptive. It can also block notifications from sites marked abusive or misleading.

That is a strong clue about the economic temptation built into the feature.

Permission has a scope problem

A user may click Allow because they expect one kind of alert.

A news reader expects important headlines. A customer expects shipping updates. A web-app user expects messages related to the service.

The technical permission, however, creates a channel. The browser does not understand the social bargain behind every future notification.

A site can therefore begin with useful alerts and gradually fill the channel with coupons, urgency tricks, affiliate offers, fake warnings, or promotional material the user never imagined when granting access.

The user did technically approve notifications.

That does not make every later use equally expected.

The valuable asset is interruption

Push advertising differs from a banner sitting quietly on a webpage.

The notification leaves the site and enters the operating environment: desktop corner, notification center, lock screen, or mobile alert stack.

That interruption is the commodity.

Once enough sites compete for it, browsers have to become permission managers and abuse filters rather than passive delivery pipes.

Chrome’s increasingly aggressive controls are an example of the platform absorbing the cleanup cost.

The broader Spam Empires lesson is that industrial promotion constantly searches for channels with higher attention than ordinary ads.

A browser notification began as a way for useful sites to tell you something happened.

The moment marketers realized it could also say SALE ENDS IN 17 MINUTES, the permission prompt became part of the battlefield.

Posted on by

Unsolicited SMS campaigns and the mobile attention market

A text message is hard to ignore because it arrives in the same place as family, work, emergencies, delivery notices, login codes, and the person asking whether you remembered the milk.

That makes SMS valuable.

It also makes unwanted SMS unusually intrusive.

The Federal Communications Commission treats text messages as “calls” under the Telephone Consumer Protection Act for relevant purposes. Its current guidance explains that certain automated or prerecorded telemarketing communications require consumer consent, and advertising or telemarketing robotexts can require prior express written consent. The FCC also emphasizes that consumers can revoke consent and that senders must honor qualifying revocation requests. See the FCC’s consumer guide on robocalls and robotexts.

The legal details depend on the kind of message and how it was sent.

Not every annoying text is automatically illegal.

But the attention economics are easy to understand.

The phone creates a premium delivery surface

Email can sit unread for hours.

A text commonly produces a lock-screen alert, vibration, sound, badge, or watch notification within seconds.

That immediacy is useful for appointment reminders, fraud alerts, shipping updates, two-factor codes, and messages a customer actually requested.

The same immediacy makes irrelevant bulk promotion expensive to the recipient.

A low-quality campaign does not merely occupy storage. It interrupts.

At scale, the sender is buying access to millions of tiny moments of attention while much of the filtering cost is pushed onto the people holding the phones and the carriers transporting the traffic.

Relevance and permission are different variables

A text can be relevant and unwanted.

A local dealership may correctly infer that a person owns a car and still have no basis to assume that person wants recurring promotional texts. Conversely, a customer may explicitly request shipping updates and be perfectly happy to receive automated messages from a company they have never spoken to personally.

That is why a serious analysis needs more than the content of the message.

It needs the source of the number, the consent record, the purpose disclosed when consent was obtained, the sending method, frequency, opt-out handling, and whether the recipient later revoked permission.

Spam Empires thrive when the phone number is treated as inventory detached from that history.

An address in a database looks like one row.

On the other end is a device somebody carries into bed.

Posted on by

Messaging-app group invitations as a mass-distribution tactic

A messaging app group is supposed to answer a simple question:

Who wants to be in this conversation?

Mass invitation tactics blur the answer.

If strangers can add people directly, or send large numbers of group invitations, the group itself becomes a distribution mechanism. The sender no longer has to contact every recipient with a traditional direct message. They only need to get people into the room—or at least put the invitation in front of them.

WhatsApp’s current privacy controls show how important that boundary has become. Users can choose who is allowed to add them to groups, including everyone, contacts only, or contacts with exceptions. When an unauthorized person cannot add someone directly, WhatsApp can instead require a private invitation that the recipient chooses whether to accept. See WhatsApp’s group privacy guidance and its advice on staying safe in groups.

That design makes the consent boundary visible.

Reachability is not group consent

A phone number being reachable on a messaging service does not mean its owner wants to join arbitrary groups.

Group membership exposes more than one incoming message. It may create ongoing notifications, reveal a phone number or profile details to other participants, and place the recipient inside a stream controlled by administrators they do not know.

WhatsApp notes that group participants can see certain information about one another, including phone numbers in ordinary groups. That makes an unsolicited addition a privacy decision as well as an attention grab.

The difference between invite and add therefore matters.

An invitation asks.

A direct addition can make the recipient clean up somebody else’s decision after the fact.

Mass distribution changes the social meaning

A legitimate group invitation usually has context: coworkers, relatives, a club, a neighborhood, a project, an event.

A promotional group assembled from scraped or purchased numbers has a different structure. The group exists primarily because the sender wants access to many recipients at once.

The platform may still call everyone a member.

That label should not be mistaken for voluntary community.

Spam Empires industrialize whatever path reliably delivers attention. Sometimes that path is email. Sometimes it is SMS.

And sometimes it is a group chat full of people whose first collective interest is figuring out who added them.

Posted on by

Cloud-document sharing notifications used as unsolicited advertising

A document-sharing notification is supposed to mean somebody wants to work with you.

That expectation is valuable.

It can also be exploited.

A stranger can create a document, put promotional text or a suspicious link inside it, and share it with an address. The recipient may then receive a notification from a familiar cloud service rather than directly from the promoter.

The infrastructure gives the message a borrowed suit and tie.

Google Drive has built dedicated anti-spam controls around exactly this problem. Its current Drive spam documentation says files and folders that are strongly suspected to be unwanted can be moved automatically into a spam folder. Users can also report shared items as spam. Once there, those items stop generating comment notifications and disappear from ordinary Drive search and suggestions.

That is not a feature built for normal collaboration.

It is a defense against collaboration machinery being used as delivery infrastructure.

The notification is part of the payload

The advertiser does not necessarily need the recipient to browse Drive voluntarily.

The useful part is the sharing event itself.

A legitimate sharing notification carries context: a coworker sent a spreadsheet, a client shared a folder, a friend sent photographs, somebody invited you to edit a draft.

An unsolicited advertiser can try to inherit that attention simply by using the same mechanism.

The cloud provider becomes an unwilling courier.

Sharing is not the same as permission

A person having a Google account does not mean they want arbitrary files shared with them.

Likewise, a business publishing an email address does not imply that every stranger has permission to create documents and repeatedly attach that address to them.

The stronger evidence of abuse is the mismatch between the collaboration feature and the sender’s actual relationship with the recipient: no shared project, no prior exchange, unrelated commercial material, repeated shares, or mass distribution.

Google’s spam view exists partly to restore that distinction.

Genuine cloud collaboration is useful because a share means something.

Spam degrades the signal by treating every address as a possible notification target.

The industrial lesson is familiar by now.

When inboxes become harder to penetrate, the message does not always get better.

Sometimes it simply learns to arrive wearing another application’s badge.

Posted on by

Calendar invitation spam that bypasses ordinary inbox attention

Email spam has one major weakness.

People expect the inbox to contain junk.

A calendar feels different.

Meeting invitations are designed to become part of a person’s schedule. Depending on provider settings, an invitation can appear as a pending event, trigger notifications, or occupy attention in a place normally reserved for appointments, deadlines, and people the recipient actually knows.

That makes the calendar a tempting side door.

Google’s current Calendar documentation explicitly includes controls for unknown senders, spam reporting, and blocking organizers. Users can choose to add invitations only after responding or only when the sender is known. See Google Calendar’s invitation controls and its guidance on reporting calendar spam.

Those controls exist because invitations can be abused.

A calendar notification has different weight

An ordinary promotional email competes with newsletters, receipts, alerts, personal mail, and everything else in the inbox.

A meeting invitation says something more urgent: this may require your time.

That framing can force a recipient to inspect material they would have ignored as email.

A promotional event title, suspicious link, fake appointment, or recurring event can therefore gain attention by arriving through scheduling infrastructure instead of ordinary mail.

The sender has not discovered a magical new audience.

They have discovered a more trusted notification surface.

Provider settings change the attack surface

Calendar spam is not equally effective everywhere.

Google now lets users restrict invitations from unknown senders and block organizers. Reported spam can be removed from the calendar. Providers can classify suspicious invitations before they become prominent.

Those controls reduce the value of the tactic.

They also illustrate the larger pattern.

Every useful communication feature creates a path from one person to another. Once that path receives more attention than ordinary email, somebody eventually tests whether it can be used for promotion, scams, or repetitive unsolicited contact.

A calendar invite was built to answer a social question:

Can we meet at this time?

Spam turns it into a delivery mechanism for a completely different question:

Can I make you look at this?

Posted on by

Contact-form spam directed at website owners

A contact form is an invitation to contact somebody.

It is not automatically an invitation to run a sales campaign through the form.

That difference becomes obvious when a small website starts receiving the same SEO pitch, web-design offer, guest-post proposal, or vague business-development message over and over again.

Cloudflare’s current guidance on protecting forms from spam and abuse explicitly lists contact forms among the common targets for automated abuse. Its recommended defenses include human verification, rate limiting, and blocking repeated patterns.

The problem is not theoretical enough to need a conspiracy.

A public form is simply a machine-readable path to a human inbox.

The form was built for exceptions

Contact forms are valuable because not every legitimate visitor fits a predefined workflow.

A customer has a strange problem. A journalist wants a quote. Somebody found a broken link. A supplier has a real proposal. A reader needs clarification.

The owner cannot predict every useful message, so the door stays open.

Bulk solicitation exploits that openness.

If a campaign submits the same pitch to thousands of websites, the sender does not need every form to work. They only need enough submissions to reach owners who read them.

The cost of each attempt is tiny for the sender and comparatively expensive for the recipient, who has to inspect the message long enough to decide whether it matters.

Availability is not blanket consent

A contact form may explicitly invite business inquiries. It may even invite sales proposals.

That does not make every submission abusive.

The relevant questions are more specific: Was the message relevant to the stated purpose of the form? Was it individually directed or obviously mass-produced? Is the same site being contacted repeatedly? Is automation being used to overwhelm forms meant for ordinary human correspondence?

Those distinctions matter because a website owner who publishes a contact channel is deliberately choosing to remain reachable.

If abuse becomes expensive enough, the predictable response is friction: CAPTCHAs, rate limits, mandatory accounts, hidden addresses, or removing the form entirely.

The spammer gains a cheap delivery channel.

Everybody else inherits a worse contact system.

That is a recurring Spam Empires pattern. The industrial sender externalizes the cost of filtering onto the people who built the useful infrastructure in the first place.

Posted on by

Forum signature spam and link-placement labor

A forum signature can be perfectly normal.

A person writes twenty useful replies about vintage radios and signs each one with a link to their repair blog. Nobody needs to call the police.

The problem begins when the conversation becomes camouflage for the link.

Google’s current spam policies give an unusually specific example under link spam: forum comments containing optimized links in the post or signature. The policy also treats paid links and automated link-creation services as manipulative when their purpose is to influence ranking.

That describes an old but important internet labor market.

Participation can be manufactured around the placement

A promotional link inside a forum signature has one advantage over a naked advertisement: it looks attached to a person participating in a community.

That appearance can be earned honestly. Longtime members often link to a personal site, business, project, or profile in their signature because it identifies them.

It can also be manufactured.

A worker or automated system can create accounts, make short replies, and leave the same commercial link beneath each post. The text above the signature may exist mainly to keep the account alive long enough for the placement to remain visible.

At scale, the operation stops resembling conversation and starts resembling distributed ad inventory assembled one forum account at a time.

The host supplies the domain reputation, the audience, the moderators, the archive, and the surrounding legitimate discussion.

The promoter supplies the link.

A link is not spam because it is commercial

The distinction matters.

A mechanic answering a repair question and linking to a detailed guide they wrote may be genuinely useful. A software developer with a project URL in a signature may simply be identifying themselves. A sponsor can buy advertising transparently.

The stronger signs of abuse are repetition, irrelevance, deceptive participation, optimized anchor text, large numbers of accounts, or posting behavior that makes little sense except as a way to place links.

Google recommends that sites mark untrusted forum and comment links with rel="ugc" or nofollow, and its guidance on user-generated spam encourages moderation, reputation requirements, and restrictions on links from new accounts.

Those defenses attack the incentive rather than the person.

If a signature link no longer buys much search value, there is less reason to employ an army of fake conversationalists to plant it.

Spam Empires are often imagined as giant mail servers blasting millions of messages.

Sometimes the factory floor is much quieter.

It is a thousand people typing “Great point, thanks for sharing” so the real payload can sit underneath their name.

Posted on by

Blog comment spam as an attempt to borrow another site’s audience

Comment spam is advertising performed on somebody else’s property.

The spammer does not build the blog, attract the readers, write the article, maintain the server, moderate the discussion, or earn the site’s reputation.

They arrive after all of that work is done and try to attach a promotion to it.

Google describes the problem bluntly in its current guidance for site owners. Spammers exploit open comment forms and other user-generated-content systems to place spammy material on sites they do not control. Google specifically recommends moderation, reputation systems, nofollow or ugc attributes on untrusted links, and other defenses. See Prevent user-generated spam on your site.

The tactic works because a comment section is not an empty textbox.

It comes with an audience.

The host supplies the valuable part

A fresh spam site with no readers has very little reach.

A comment under a popular article may be seen by real people, indexed by search engines, associated with a trusted domain, or at minimum processed by the site’s moderation system.

That is why old comment spam often looked almost absurdly generic:

“Great article! I learned a lot. Visit my discount pharmaceutical casino roofing cryptocurrency website.”

The compliment was camouflage.

The real product was the link.

Google has long warned that automatically generated comments and forum posts can bury legitimate discussion and expose a site to content it never intended to host. See Google’s earlier guidance on protecting sites from user-generated spam.

Readers and moderators pay the bill

Every junk submission has to be filtered somewhere.

Software rejects it. A moderator reviews it. A site owner empties the queue. A reader scrolls past it. A legitimate commenter waits for approval because the site had to tighten its rules.

At enough volume, the host may disable comments entirely.

That is the hidden damage.

The spammer wanted free exposure. The site responds by making genuine participation more difficult.

Comment spam therefore fits Spam Empires perfectly even when the individual message is tiny.

The sender’s strategy is not to build an audience.

It is to borrow yours until you put up a fence.

Posted on by

The division of responsibility among hosts, ad networks, payment services, and platforms

A deceptive website is rarely just a website.

It may use one company for the domain, another for hosting or security, a third for advertising, a fourth for payment, and a fifth platform to find victims. The browser may maintain its own phishing blocklist. The victim’s bank may control a dispute process. Law enforcement controls none of those systems directly but may investigate the people behind them.

That makes the obvious question — Who is responsible for taking this down? — harder than it sounds.

Different companies control different levers

An ad network can stop buying traffic for the scam.

Google’s advertising policies prohibit phishing, malicious software, and ads that impersonate trusted entities. Enforcement can therefore remove an advertiser or destination from the ad system even if Google does not host the underlying site.

See Google’s phishing policy and malicious-software advertising policy.

A hosting provider can potentially remove content it actually hosts. A registrar controls the domain registration relationship. A security or CDN provider may only sit between the visitor and an origin server.

Cloudflare’s abuse documentation explicitly notes that what it can do depends on which Cloudflare service the reported site uses. A site merely passing through Cloudflare’s network is a different situation from content hosted on Cloudflare infrastructure or a domain registered through its registrar.

See Cloudflare’s abuse-reporting documentation.

A payment provider or card issuer controls another layer. It may be able to stop a merchant relationship, investigate a transaction, or process a dispute. The FTC advises marketplace buyers who paid by credit or debit card to dispute fraudulent transactions with the card company while also reporting dishonest sellers to the marketplace and regulators.

See the FTC’s online marketplace guidance.

The gaps appear at the handoffs

Each participant can truthfully say it does not control the entire fraud.

That can still leave the victim with a live scam.

The ad network may remove the ad while the site remains online. The host may act while a replacement domain appears. The payment path may close while the scammer switches processors. A marketplace may remove an account while the same operator continues through search ads or social media.

No single intervention is guaranteed to erase the operation.

But that does not mean nobody has meaningful power.

Practical ability is not the same as legal duty

It is useful to separate two questions.

What can this company technically or contractually do?

And what is this company legally required to do?

The first can often be answered from the provider’s service role and published policies. The second depends on jurisdiction, facts, contracts, regulatory rules, and sometimes litigation. It should not be guessed from a company’s ability to press a button.

The distributed web creates distributed responsibility.

That architecture is resilient when no single company can control everything.

It is maddening when a victim discovers that the same decentralization also means the scam can exist in the spaces between companies that each control only one piece.

The practical answer is not to search for one universal sheriff of the internet.

It is to identify every lever the operation depends on — visibility, domain, hosting, account, payment, browser trust, and law enforcement — and make sure the report reaches the party that can actually move that lever.