A comprehensive Threat Intelligence and OSINT investigation into the infrastructure, tactics, and technical execution of "Task Scam" operations. This repository documents the backend vulnerabilities, frontend manipulation techniques, and server fingerprinting used by threat actors to deceive victims.
"Task Scams" are financially motivated cybercrimes where victims are recruited (often via WhatsApp, Telegram, or SMS) to complete menial online tasks (e.g., liking videos, submitting fake reviews) for small initial payouts. As the scam progresses, victims are directed to fraudulent web platforms where they are required to pay increasingly large "fees" or "taxes" to unlock their supposed earnings.
This project focuses on the technical infrastructure behind these platforms. By analyzing exposed APIs, server configurations, and UI deception tactics, this repository provides actionable intelligence on how these scam networks operate and how their infrastructure can be tracked.
flowchart TD
classDef victim fill:#1f2937,stroke:#64748b,color:#f8fafc
classDef actor fill:#7f1d1d,stroke:#ef4444,color:#fef2f2
classDef infra fill:#7c2d12,stroke:#f97316,color:#fff7ed
classDef frontend fill:#164e63,stroke:#06b6d4,color:#ecfeff
V(["Victim"]):::victim
TA["Threat Actor (Recruiter)"]:::actor
OP["Threat Actor (Operator)"]:::actor
subgraph Scam Infrastructure
UI["Frontend Web App<br/>(UI Manipulation)"]:::frontend
API["Backend API<br/>(Exposed Endpoints)"]:::infra
DB[("Database<br/>(Victim Ledgers)")]:::infra
end
TA -->|Initial Contact & Phishing Link| V
V -->|Registers & Logs In| UI
OP -->|Modifies Fake Balances| API
UI <-->|Fetches Tasks & Balances| API
API <--> DB
The investigation is documented across several specialized reports. Please review them in the following order:
| Document | Description |
|---|---|
| Investigation | The core DFIR/OSINT methodology, timeline of the investigation, and initial discovery of the threat actor's infrastructure. |
| Fingerprinting | Technical details on how the scam servers were identified, including TLS certificates, ASNs, open ports, and reverse-proxy behaviors. |
| UI Manipulation | Analysis of the frontend JavaScript and DOM manipulation tactics used to display fake user balances, simulated payouts, and fabricated live chats. |
| API Exposure | Documentation of insecure Direct Object References (IDOR), lack of authentication on backend endpoints, and data leaks found within the scam's API structure. |
- Insecure APIs: Many of these platforms are rapidly deployed clones with poor security hygiene. The
API_exposure.mdreport details endpoints that leak operational data without proper authentication headers. - Frontend Illusion: The
ui_manipulation.mdanalysis breaks down how the platforms generate a false sense of urgency and legitimacy using hardcoded scripts to simulate active users and withdrawals. - Infrastructure Tracking: The
fingerprinting.mdsection provides YARA rules, Shodan queries, and specific server headers that can be used by security researchers to hunt down newly deployed scam nodes before they become fully operational.
This repository is for educational, defensive, and research purposes only. The methodologies, indicators of compromise (IOCs), and technical analyses provided here are intended to assist cybersecurity professionals, law enforcement, and researchers in identifying and disrupting fraud networks. Do not interact with or attack the documented infrastructure.
This project is licensed under the terms outlined in the LICENSE file.