Category: Dead Internet Theory (DIT)

Dead Internet Theory (DIT) explores the idea that the open, human-driven web is being steadily replaced by automated content, algorithmic feeds, corporate platforms, abandoned websites, SEO spam, bots, and machine-generated noise.

This category investigates the evidence behind that idea without treating every claim as fact. We look at vanished communities, once-massive websites turned into digital ghost towns, bot networks, content farms, spam empires, dead links, abandoned forums, artificial engagement, platform consolidation, algorithm-driven culture, and the strange remains of the older internet.

Some of it is conspiracy theory. Some of it is ordinary technological change. And some of it is plainly visible to anyone who remembers what the web used to feel like.

These articles document the transformation of the internet from a sprawling collection of strange, independent places into something increasingly centralized, automated, commercialized, and difficult to distinguish from its own simulations.

Welcome to the archaeological layer of the modern web.

Posted on by

Malicious advertisements delivered through apparently ordinary websites

You can be on the right website and still be looking at the wrong advertisement.

That is the uncomfortable part of malvertising.

Microsoft defines malicious advertising as a situation in which an attacker submits malicious content to an advertising network and that content is then hosted by a benign website. Its SmartScreen documentation even includes a demonstration scenario described as a benign page hosting a malicious advertisement.

See Microsoft’s SmartScreen explanation of malvertising.

The publisher does not have to be the attacker.

The ad can come from somewhere else

Modern websites often sell advertising space through networks and exchanges rather than selecting every advertisement manually.

The page belongs to the publisher. The ad may be supplied through an external advertising chain.

That separation is useful for legitimate advertising because it lets publishers fill inventory automatically. It also creates a place where malicious creatives, redirects, fake warnings, or dangerous destinations can enter the page without the site’s ordinary editorial content being compromised.

Google’s own Ad Manager documentation warns publishers about ads that trigger automatic redirects or pop-ups and classifies them as malvertising. Google says it scans creatives and blocks malicious content, while also noting that third-party exchanges and other demand sources may have different protections.

See Google’s Ad Manager guidance on malware in ad content.

Trust in the host leaks into the advertisement

Users rarely think about the supply chain behind a rectangle on a webpage.

If the surrounding site is familiar, the advertisement benefits from the site’s reputation. A fake update, fake security warning, investment offer, or download button can feel less suspicious because it appeared inside a place the user already trusts.

But ad placement is not an endorsement of the destination.

Microsoft notes that malicious ads can redirect users to phishing sites, initiate unwanted downloads, or push people toward further social-engineering steps.

Treat the click as a new destination

A reputable publisher is evidence about the publisher.

It is not proof about every advertiser delivered through that page.

Before entering credentials, downloading software, or paying for something reached through an ad, inspect the destination as a separate site. Check the domain. Reach the company independently if the offer involves an account or service you already use. Prefer the vendor’s known website for downloads and sensitive transactions.

Malvertising exploits a mental shortcut that normally works well: I trust this place, therefore the things inside this place are probably safe.

Advertising networks make that conclusion less reliable.

The webpage can be legitimate while one rectangle inside it is somebody else’s trap.

Posted on by

Fake CAPTCHA prompts that ask users to perform unsafe actions

A CAPTCHA is supposed to ask the website a question about you.

It is not supposed to ask you to operate the computer on the website’s behalf.

Microsoft has documented a social-engineering technique known as ClickFix in which attackers imitate familiar human-verification pages such as CAPTCHA, reCAPTCHA, or Cloudflare-style checks. Instead of merely asking the visitor to click a box or solve a challenge, the fake page gives instructions that lead the user into running a command on the computer.

See Microsoft’s analysis of ClickFix.

The request stops matching the job

A legitimate human-verification challenge exists to distinguish a person from automated traffic.

It may ask you to click a checkbox, identify images, wait briefly, or complete some other interaction inside the browser.

The fake version changes the assignment.

It might tell you to open a system dialog, paste something from the clipboard, launch a terminal, or perform some unrelated sequence of operating-system actions. Microsoft says ClickFix campaigns use exactly this mismatch to get users to initiate the infection themselves.

That is the useful warning sign: the “verification” begins asking for capabilities that a normal CAPTCHA does not need.

Familiarity lowers suspicion

CAPTCHAs are annoying but ordinary. People have been trained to comply with them quickly because they appear during sign-ins, downloads, ticket purchases and other routine web tasks.

Attackers borrow that muscle memory.

Microsoft has observed fake CAPTCHA pages used in campaigns that ultimately install information-stealing malware or remote-access software. Its security intelligence also classifies fake CAPTCHA behavior as a social-engineering technique rather than a real verification system.

See Microsoft’s FakeCaptcha threat description.

A CAPTCHA should stay in its lane

If a human-verification page suddenly asks you to open Windows Run, PowerShell, Terminal, or another system tool and paste or execute something, stop.

Do not finish the instructions merely because the page says they are required.

Close the page and return to the service through its known address. If the site genuinely requires verification, it can present a normal challenge again.

The fake CAPTCHA depends on one assumption: that a familiar box labeled I am not a robot will make every instruction beneath it feel equally legitimate.

It should not.

The moment the test asks you to become the installer, the test has changed.

Posted on by

Tech-support scams that turn an alarming pop-up into remote access

The pop-up is not the main event.

The remote-control session is.

The Federal Trade Commission describes a common tech-support scam in which a bogus warning claims the computer has a virus or other serious problem and tells the user to call for help. The supposed technician then asks for remote access to the computer, pretends to diagnose an infection, and sells an unnecessary repair or uses the access for something worse.

See the FTC’s guide to tech-support scams.

Remote access changes the problem completely

Before remote access is granted, the scammer has a story.

After remote access is granted, the scammer may be able to see what is on the screen, manipulate files, install software, observe passwords, or guide the victim through banking and payment steps while appearing to “fix” the machine.

The FTC has brought cases involving operators who used frightening pop-up advertisements, claimed affiliation with Microsoft or Apple, and persuaded people to allow remote access. Once connected, the operators pointed to harmless system information as supposed evidence of infection and sold unnecessary services.

See the FTC’s 2019 refund announcement involving a tech-support operation.

The crucial move is therefore not the fake scan. It is the transfer of control.

Break the chain before the technician becomes “trusted”

If an unexpected warning tells you to call technical support, do not use the number in the warning.

If someone contacts you unexpectedly and says your computer has a problem, do not give that person remote access.

Instead, close the message and contact the software vendor, device manufacturer, employer help desk, or another trusted technician through contact information you obtained independently.

Microsoft states that it does not make unsolicited calls offering technical support and that genuine Microsoft error messages do not include phone numbers telling users to call.

See Microsoft’s tech-support scam guidance.

A convincing scammer may know real technical terms. The remote-access program itself may also be legitimate software commonly used by actual support departments.

Neither fact proves the person on the other end should control the machine.

The authority has to be verified before access is granted, not after the stranger is already moving the mouse.

Posted on by

Browser warnings impersonating an antivirus product

A web page that says FIVE VIRUSES DETECTED has already accomplished one thing.

It made the browser look like a security product.

Microsoft documents tech-support scam pages that display fake error messages, switch the browser into full-screen mode, trap users in repeated pop-ups, and present a phone number for supposed technical help.

The important clue is that the warning is coming from the page, not from the security product it claims to represent.

See Microsoft’s guidance on tech-support scams.

A claim of a scan is not evidence of a scan

A deceptive page can put almost anything on the screen: a progress bar, a list of infected files, a familiar antivirus logo, flashing red borders, siren sounds, or a percentage counter labeled Scanning....

Those graphics prove that the webpage can draw graphics.

They do not prove that the named antivirus company inspected the computer and found the threats listed on the page.

Microsoft makes one particularly useful distinction: genuine Microsoft error and warning messages do not include phone numbers telling users to call support.

That simple rule breaks a large family of scare pages.

Leave the page before diagnosing the machine

If a browser page suddenly announces a severe infection, do not use the page itself as the route to diagnosis.

Close the tab or browser. If the page has trapped the browser in full screen or repeated dialogs, use the operating system to close the browser rather than clicking buttons inside the warning. Then open the security software already installed on the machine and run its normal scan or update process.

Microsoft also recommends downloading software only from official vendor sites or trusted application stores rather than from links supplied by the warning.

See Microsoft’s Defender guidance on support-scam pages.

A real security alert can certainly be urgent.

The difference is authority.

Your installed antivirus, operating system and browser have defined ways to report danger. A random page that suddenly claims to represent one of them is merely a page until independently verified.

The scareware trick is to collapse those two things into one.

It wants the message about your security software to be mistaken for a message from your security software.

Posted on by

Fake customer-support accounts that intercept requests for help

Posting a public complaint can accidentally create a customer-service wanted ad for scammers.

You identify the company. You describe the problem. You reveal that you want help now.

The impostor only has to answer first.

In 2024, the Federal Trade Commission warned that scammers were monitoring social media for travelers complaining about airline delays and cancellations. Fake customer-service accounts then contacted those travelers pretending to represent the airline.

The scammers asked for booking information, phone numbers, bank details, or directed victims to spoofed websites.

See the FTC’s warning about airline customer-service impersonators.

The scammer already knows the problem

This attack has an advantage over a random phishing message: context.

If you just posted that your flight was canceled, an account replying with “We can help with your rebooking” does not have to guess what will get your attention.

The public conversation supplied the script.

A copied company logo, a support-sounding username and a polite reply can be enough to move the conversation into direct messages, WhatsApp, text messages, or a fake form where the requests become more sensitive.

That is why apparently relevant information is not proof that the responder is legitimate. The scammer may know the details simply because you posted them publicly.

Verify the channel, not the tone

The safest way to confirm support is to approach the company independently.

Open the airline, bank, retailer or service’s official website or app and find its support channel there. If the company lists official social-media accounts, follow those links from the company’s own site rather than trusting a username that looks close enough.

The FTC specifically recommends contacting airlines through their official app, website, chat, phone number, or an in-person representative. It also warns against sharing personal information over social media.

This matters because good manners are easy to imitate.

A fake support account can apologize, use your name and promise to escalate the case. None of that gives it authority over your reservation, account, refund or money.

Public customer service creates a strange asymmetry: everybody can see who needs help, but the customer may have difficulty seeing who actually has the right to provide it.

That uncertainty is exactly where the impostor works.

Posted on by

Imitation storefronts built around stolen retail identities

A fake store does not have to invent a convincing retailer.

It can steal one that already exists.

In 2025, after JOANN announced store closures and liquidation sales, the Federal Trade Commission warned about bogus websites advertising supposed online JOANN bankruptcy sales with discounts of 80% to 90%.

The useful detail was simple: the real liquidation sales were happening in physical stores. JOANN was no longer selling online. The websites using the brand online were not an unusually generous version of JOANN. They were impostors.

See the FTC’s warning about fake JOANN sales.

Familiar branding supplies borrowed credibility

A copied storefront can reuse almost everything a shopper recognizes: company name, logo, product photography, category structure, sale banners and even fragments of policy text.

None of those elements prove who is actually taking the payment.

That is the important gap.

The page may say JOANN, Nike, a local dealership or some other established retailer. The merchant processing the payment can still be an unrelated party operating a different domain.

The FTC says scammers commonly impersonate real companies in social-media ads and lead shoppers to fake sites offering famous brands at unusually low prices. Victims may receive a counterfeit item, something unrelated, or nothing at all.

See the FTC’s guidance on brand-name shopping scams.

Check evidence outside the store

A fake storefront controls everything inside its own page. That means its reviews, countdown timers, stock warnings and claims about a liquidation sale are weak evidence.

Useful checks happen somewhere the seller does not control.

Go independently to the retailer’s known website. Search for the seller’s domain and company name with words such as scam, complaint or review. Compare the advertised price with established retailers. Check whether the company’s official channels even acknowledge the sale.

When paying, a credit card generally provides stronger dispute protections than gift cards, wire transfers, cryptocurrency or other hard-to-reverse methods. The FTC specifically warns against sellers that insist on those difficult-to-recover payment methods.

A copied logo is cheap.

A real commercial identity is harder to fake once you stop asking the storefront to verify itself.

Posted on by

Typosquatted domains that exploit small typing errors

The difference between the right website and the wrong website can be one missing letter.

That is enough.

Typosquatting is the practice of registering a domain that resembles a familiar one closely enough to catch people who mistype the address or fail to notice a small change. Microsoft gives the simple example of a missing letter in a company name; ICANN’s security work describes the same problem with lookalike domains such as faceboook.com or goggle.com.

See Microsoft’s explanation of typosquatting and ICANN’s DNS security study.

The trick is effective because users usually recognize a domain as a shape, not as a forensic specimen.

Familiar enough is often enough

A mistyped address may lead to a harmless parking page full of ads. It can also lead to a copied login page, a fake store, or a malware download.

The attacker benefits from recognition already earned by somebody else. The colors, logo and layout can all imitate the legitimate service. The domain only needs to survive a glance.

The browser’s lock icon does not solve the problem. Encryption can protect the connection to the wrong site just as effectively as it protects the connection to the right one.

That means the useful question is not simply, “Is this connection encrypted?”

It is, “Who owns the address I actually reached?”

The visible address is evidence

Before entering a password, payment card, recovery code or other sensitive information, look at the registered domain itself rather than the page design.

A scammer can copy the page. The scammer cannot place a fake page at the genuine domain unless that domain has also been compromised.

Microsoft recommends using saved favorites for important banking, shopping and social sites instead of retyping the address each time. Modern browsers may also warn about common mistyped domains, but those protections are assistance rather than permission to stop looking.

The FBI makes the same general point in its phishing guidance: carefully examine URLs and spelling because scammers deliberately use small differences to gain trust.

See the FBI’s spoofing and phishing guidance.

Typosquatting is almost insultingly simple.

That is why it remains useful.

The attacker does not need to defeat the real website. The attacker only needs to stand one character away from it.

Posted on by

Fake download buttons that divert users from the intended software

A software download page should contain one obvious answer to one obvious question.

Where is the download?

The predatory version contains four answers, three of them lying.

Fake download buttons work because users arrive with their attention already narrowed. They know the program name. They want the installer. A large button saying DOWNLOAD NOW feels like navigation rather than advertising.

That visual assumption is the target.

The advertisement borrows the job of the page

Google’s advertising policies explicitly prohibit misleading designs such as image ads containing download or install buttons and ads that resemble system messages or site controls.

Its AdSense guidance is even more direct: ads should be kept away from download buttons because users may mistake the advertisement for the download link.

See Google’s misleading ad design policy and AdSense policy guidance.

The rule exists because the confusion is predictable.

An unrelated installer does not have to defeat the user’s security software if it can first convince the user to run it voluntarily.

Sometimes the whole page is the fake button

Mozilla has documented fake Firefox update pages and advertisements that tell users an urgent or critical browser update must be downloaded manually. Mozilla identifies these as scam tactics used to distribute malware or malicious extensions.

Firefox normally updates automatically and provides its own built-in update mechanism. A random webpage demanding an executable is not part of that process.

See Mozilla’s fake Firefox update warning.

The Federal Trade Commission gives similar advice for software advertised through search engines and social media. Criminals can buy ads for recognizable software, send the click to a cloned site, and deliver malware instead. The FTC recommends bypassing the advertisement and going directly to the software publisher’s site.

See the FTC’s consumer alert on fake software ads.

The genuine path is usually less exciting

A real download link does not need to scream.

Before running an installer, identify the publisher first. Confirm the domain belongs to the developer. Prefer the developer’s own download page or an official application store. Check that the filename and digital signature correspond to the software you intended to install.

Do not assume the largest button is the correct one merely because it is visually dominant.

That is the entire trick behind the fake-download-button economy.

The user thinks the page is helping locate software.

The page is sometimes auctioning the moment immediately before the click.

Posted on by

Conditions under which a platform can improve after a period of decline

Platforms can get better.

That sounds obvious, but it is easy to lose sight of after watching enough products accumulate ads, remove features, cut support, and call the result an upgrade.

Flickr offers a useful case because the recovery effort involved more than changing the logo.

Ownership changed first

SmugMug acquired Flickr from Yahoo in April 2018.

Flickr later described itself as having faced the threat of closure before the acquisition. SmugMug, a privately owned photography company, said it intended to keep Flickr focused on photographers rather than fold it into an unrelated advertising or social-media strategy.

See Flickr’s acquisition announcement and its 20-year development history.

Promises are cheap, though.

The useful question is what changed afterward.

Recovery became visible in boring infrastructure

Flickr began migrating away from Yahoo’s systems and into new infrastructure. In 2019 it removed the long-standing requirement that users authenticate through Yahoo accounts. Flickr said the move off Yahoo infrastructure improved reliability and that SmugMug’s investment allowed the service to add engineers and support staff.

Its 2019 review reported that all systems and photographs had been migrated, Yahoo login dependence had been removed, and support capacity had increased.

See Flickr’s 2019 review and login migration announcement.

Those are better recovery indicators than a launch campaign.

A platform improving should produce changes users can verify: fewer dependencies, more reliable infrastructure, fixed workflows, functioning support, reduced spam, or sustained delivery on announced work.

Incentives have to support the improvement

SmugMug publicly framed Flickr as a photography business serving photographers. It also emphasized subscription revenue rather than treating user data and advertising as the primary business.

That does not make every Flickr decision popular or prove that the service became perfect.

It gives the recovery effort an incentive structure that can plausibly last beyond one quarter.

This is the important distinction.

A temporary discount can make users happier for a month. A redesign can create the appearance of motion. An apology can acknowledge failure.

Lasting recovery usually requires something deeper: leadership willing to name the problem, money spent on the unglamorous parts, measurements that show the service actually works better, and a business model that does not immediately reward recreating the old problem.

Platforms decline through incentives and operations.

They generally recover the same way.