Spam YouTube Comments are Getting Weird…
I will be updating this story as I discover more.
I found this rather odd comment on a scam baiting YouTube channel, called Pleasant Green. I enjoy his content from time to time and while I don’t normally venture into the YouTube comments I found myself there. Looking at this rather odd message. Surprisingly this wasn’t the only one with this same type format. Praising the video, the randomly dropping a name in bold. The one above being ExelaSupport.
These next few talk about something called GrindTechiei.
(Odd punctuation and grammar suggests this might not be AI, although it feels like it.)
Same sort of praise with the random name/thing being added near the start of the sentence.
At first I thought it might be a bot that was using these messages as proof to someone that they can post YouTube comments without getting flagged by spam. In order to sell their services. After a little more thought, this felt like either, a bot that went a little rogue with its spam messages, targeting the wrong account. Or a message that was trying to get people to look into these names a little more. Hence the bold text in some comments.
There was another name that came up while scrolling a little. Scripttron.
This one had a whole comment chain from another account that asked questions…kinda? Poor English and grammar in these messages feels really odd. Engagement spam is rather common among YouTube comment scams.
1 account posts something along the lines of: “John Smith made me a ton of money investing for me!”
The next account will respond with: “Oh wow I have never heard of John Smith, tell me more!”
Then a whole “conversation” takes place about how John Smith is great at investing and you should look them up and/or call them for more information. Leading to an investment scam. These have seem to have died down somewhat, or at least I have no encountered them recently.
Now, lets get back to the messages shown above. They all follow the same type of format, indicating they are either using the same type of playbook or they are done by the same entity/bot.
I want to look into this ExelaSupport thing first.
After a little search for the word Exela, I stumbled across a few different online Exela brands. The first being a Pharmaceutical company. Seems fine on the face of things.
The second being a business process automation company. Which looks to have a spot on the NASDQ with the ticker: XELA. This company looks like it might be going out of business, filing chapter 11 bankruptcy. $1.3B worth of debt, which I am not sure a few spammy YouTube comments will help out with, so I can rule them out.
The next search I did was for the exact phrase exelasupport, which gave me a few interesting hits. An Instagram page and a TikTok.
This seems to be a cybersecurity firm/a group of experts spreading knowledge on crypto scams. Of course this would lead to crypto. The YouTube comment section to crypto pipeline is a short one.
Looking over some of the photos/videos these accounts seem to be an Australia based. Using logos of Australia and specifically referencing the Australian Government. Some of their TikToks have a decent number of views. One strange thing I did notice when looking at one of their TikTok’s was a location tag for “Jessica Silva Beauty — AUS 🇦🇺 · Brisbane”. Weird tag for a video about spotting scam investments.
It didn’t take long to find out the true nature of this account. A crypto recovery service.
Most of the videos look to be stolen content with an AI voice over talking about how they can help you recover your stolen crypto.
This turned out to not be that exciting. This seems to be just another crypto recovering scam service that will probably take your money without attempting to get your crypto back. Spamming YouTube comments with strange yet quite generic messages that are used to entice viewers to look them up. The issue being, this takes quite a bit of searching to get anywhere near to getting in contact with them. I did find a US telephone number which after looking up, had someones real information attached to, and a telegram username. It also seems that they have had multiple Instagram accounts that have been banned over time.
Updating this over time as I discover more types of strange YouTube comments.
“Investment” Comments
I thought I would add more to this story as I find more strange comments that are obvious scams.
These kinds of comments I have found are more common than ever. They seem quite unassuming on the surface, vaguely relating to the content of the video. Most of the time they need/want random real humans to upvote the comment and then to explore the replies, so making a rather general statement that would apply to a wide variety of people is a good way to go about this.
Then seeing a large replies section, people are more than likely to click into it and read the replies.
They waste no time getting to the scam. The first reply, within seconds its posted, responds on how well their life is going now. Most often quoting some insane monetary figure that they now earn. In this case, $75,000 biweekly…almost $8m a year…lmao.
Now most people at this point would be able to put 2 and 2 together and realise, this is a scam. But it goes a little deeper.
Terrible grammar and strange punctuation
This comment by a third account adds a little more social proof/legitimacy.
The social proof just keeps piling on and on. There are a couple of things to note about these accounts and comments. Firstly, every single one, has a basic naming scheme.
[First Name][Last Name]-[Letter][Number][Letter]
The other thing to note, is how they type. Very Facebook boomer language and formatting to their sentences.
Shortly after this interaction and social proof posting, comes the method of contact being laid out by the original reply person. A sneaky way to dodge the comment section moderation. Separating an entire US based phone number into 3 comments. A reverse look up of the phone number didn’t reveal too many results, although some of said results might be behind paywalls. I would hazard a guess and said its more than likely a text app number, linked to an app.
The comment chain carries on, with more people asking how to get involved with a second person using the same technique to post the number.
This is a rather unsophisticated way of snagging victims. Especially on a channel that is dedicated to cyber security. Although this method doesn’t take long to do and is a more fire and forget strategy.
For creators on the platform, this might be a little hard to spot amongst the waves of comments their videos get. Since the actual scam starts in the replies, not with the initial message. Meaning the likeliness of a creator seeing this exchange is minimized.
Last updated