BANNEER: “RENT A FB ACCOUNT AND EARN FROM IT.” (Source: rentfb/archive)

By Roman Osadchuk

A digital marketing agency deployed a multi-platform operation to pursue Facebook users willing to rent their accounts in exchange for money. In exchange for a fee, the marketers in question, who refer to themselves as “Target Agency” on social media, could exploit the rented account to run advertising, including those that violate Facebook policies, while mitigating the risk of being de-platformed.

The scale and character of is effort suggest a multi-vector operation to recruit participants as covertly as possible. The DFRLab identified a network of TikTok ads, Instagram accounts, YouTube channels, Telegram accounts, and multiple standalone websites that promise remuneration in exchange for access to individual Facebook user accounts.

Certain marketers exploit rented accounts as a means of avoiding Facebook restrictions around the number of ads a single profile can run at a time. While this particular case is by no means the first time marketers have tried to find users to lease their accounts for commercial use, it underscores how bad-faith actors can circumvent Facebook policies to promote problematic content or products. For example, the DFRLab recently documented a number of cases of marketers selling fake COVID vaccine certificates on the platform.

Facebook’s Community Standards prohibit users from maintaining more than one personal account; doing so would be considered in violation of the platform’s account authenticity requirement. As such, knowingly seeking to use other individuals’ accounts to advertise one’s own products is likely also in violation of their standards.

In this case, the individuals behind this operation sought to recruit Ukrainian user accounts from which they would post advertisements in other languages targeting other countries. The operators promised interested parties a passive income through the rental of their Facebook user accounts, offering 600 UAH (approximately $22 USD) per week and up to 2,500 UAH (approximately $92) per month in exchange for the use of their account’s advertising ability. They used feeder webpages to describe the operation, including how the user would be remunerated — namely, transferring cash directly to their credit card. These feeder pages presented themselves as a digital agency, explaining that they required access to additional accounts to get around Facebook’s limitations on the number of ads a single account can run.

The feeder webpages typically offered long-term rental agreements ranging from six months to two years. The pages also promised a referral reward of around $3 per referral for those who could recruit other individuals to participate. At the same time, the feeder pages also provided a list of requirements for an account to be valid to participate, including that the given account must have more than 40 friends, have uploaded pictures, and be older than five months. The webpages also declared that a participating account nor its connected friends would see the ads, because the ads would target Europe and Asia with “home goods, phone apps, and cosmetics” through the platform’s ability for advertisers to select recipient audiences, including by country.

The feeder pages also provided contact information of managers who would be the point of contact for further inquiries and agreements. Usually, the feeder pages linked to accounts on Telegram, Viber, and, with a few exceptions, TikTok and Instagram. The DFRLab started its investigation after first seeing the recruitment advertisements posted to TikTok accounts featuring Ukrainian influencers.

Four TikTok videos associated with Target Agency, as identified by the DFRLab, featured a person describing the benefits of receiving passive income by renting a Facebook user account, claiming that the phenomenon is not new but that they had just recently “discovered” it. In several instances, the digital agency employed Ukrainian TikTok influencers to advertise an opportunity “to earn money on Facebook.” For instance, in a now-deleted video, an unnamed woman pitched an opportunity to earn money from their Facebook page. While the promotional video did not identify her by name, the person in the video appears to be Ekaterina Kulichenko (tetya_mottya), a TikTok blogger with more than 1.7 million followers.

Another video featured an unnamed man highlighting how people could earn money by renting out their Facebook accounts. The DFRLab identified the featured speaker as koolhoznik, an Instagram blogger with more than 60,000 subscribers. The other two now-deleted videos featured different people that the DFRLab could not identify. It is also unknown whether these videos were originally recorded for TikTok, or for platforms like Instagram, where some of them also had user accounts.

The TikTok videos identified by the DFRLab prompted users to click on a number of external marketing websites, including one.agencytarget.online, two.agencytarget.online, rentarget.live, and one.taragency.online. While the first two are subdomains of the website agencytarget.online and the others have unique URLs, the content on all four websites was identical, though one.taragency.online featured text in Ukrainian rather than Russian. They used identical visuals and descriptions and provided the same contact information, listing the same Telegram and Viber accounts. All of the websites pointed to the Telegram account @tikagency, dubbed Target Agency, and the Viber account @fbaccs, with the text “Hello! I’m from the website rentarget.live. I’m interested in leasing a FB account.”

The website taragency.online had at least seven subdomains that began with a number in English, from one to seven; for example, the final subdomain had a URL of seven.taragency.online. Those websites have now been blocked by the service provider, and it is not known whether any of them except for the “one” subdomain was in use. The DFRLab identified a similar strategy applied to the subdomains of agencytarget.online, two of which (“one” and “two”) worked, while another two (“three” and “four”) were registered but blocked at the time of analysis.

The websites led to the @tikagency Telegram account featuring a June 17, 2021 profile photo displaying the name “Target Agency” and a logo. The account previously featured a profile photo for a different entity, “Market Master,” accompanied by the description, “Facebook account rental.” This profile image dated to December 28, 2020.

A YouTube search for “Target Agency” revealed a channel by the same name that used the same June 2021 profile picture as the Telegram account. The channel uploaded two videos, both of which featured “satisfied customers” describing their experience with earning money on Facebook. In both videos, people mention Target Agency by name. The “About” page for the channel states in Russian, “We’re Target Agency, and we rent Facebook accounts,” and included a URL to the website one.bulbusiness.online. This page promoted similar services as the webpages detailed above but had a distinctively different design. However, it too led users to Telegram channel @tikagency and provided the exact same message prompt for the same Viber account.

The most notable aspect of this website, however, is that it used Google Tag Manager, a Google tool that facilitates website management, including services for advertisements and statistics. Google Tag Manager assigns a unique ID to a single account that can then be used for other websites. After conducting a query using the technology tracking tool BuiltWith, the DFRLab found the same unique ID attached to ten different websites.

These websites used a similar layout and design as the landing websites from TikTok. Three of them copied each other’s design, displaying the name of the now-defunct website arend.fb.ua in their description and design.

One of the ten websites using the Google Tag Manager ID was written in Turkish and promised payment in Turkish liras. This page led to a Viber account by the name of “Mastermarket” — echoing the older profile picture for the @tikagency Telegram account — and a Facebook Messenger link to a Facebook page for Target Agency. The page has a single review — “Fraud,” written in Ukrainian.

While most of the websites advertised opportunities for users to rent their Facebook accounts, at least one, bigrenta.com, also offered money to register accounts on specific websites and services. Bigrenta.com has a different design but still used Target Agency’s logo. The operators say they will provide ‘three to five websites to register on’ and ‘pay up to $183 per month on simple registrations.’ Notably, this website — unlike all of the others uncovered as a part of this investigation — leads to a Telegram account with a Coinlist logo as a profile picture and bio that promises up to “$18.32 for registration on websites.” Coinlist is a platform for cryptocurrency trading, raising the possibility that Target Agency was asking people to register on this platform in exchange for money.

The ten websites identified by Google Tag Manager also led to another set of Telegram and Instagram accounts; some of the latter accounts were no longer functional. The DFRLab investigated the three Instagram accounts that remained online at the time of research. All of the Instagram accounts utilized stolen images to populate their pages in an effort to appear to be authentic users promoting the account-rental service.

The first website, fbarendaacc.website, included contact information for an Instagram account with the handle adel.ina3335. The account portrayed itself as a young woman promising to pay for the use of Facebook accounts and had 1,837 followers at the time of writing. The account also shared multiple screenshots of supposed payments as evidence that the scheme is legitimate. To further boost its appeal to future clients, the account featured a few seemingly personal photos. All of them, however, were stolen from a separate, seemingly authentic user account.

Similarly, the second website, fbarendua.website, provided a URL for another Instagram account, litvi.alisa, as a point of contact. It also used photos stolen from another seemingly authentic user account. In its first post, litvi.alisa complained that its previous account had been blocked, a likely reference to the now-defunct Instagram handle alisa_litvi_ that was linked to by ten of the marketing websites. The second post declared that the user is a manager of rented Facebook accounts and represented a company called arend.fb.ua, the same name as the now-defunct website discussed earlier. In a recent video post, she asked people to follow her TikTok account fb.manager, which features arend.fb.ua on its profile picture.

A Google search for “arend.fb.ua” revealed another Instagram page with an identical name that claims to be “one of the leading official companies that lease Facebook accounts,” featuring “8,000 people in its client base.” The account even included a photo of the alleged team running the company, bragging it operated in eight countries and was “not hiding their faces,” but the photo was stolen from a Russian real estate agency, according to a Yandex reverse image search.

The Target Agency network demonstrates that shady digital advertisers use multiple platforms to obtain user credentials on Facebook and other websites that might be used for advertising or other operations. While the network is by no means unique, it allows lifting a curtain on how similar actors try to find new ways to work around Facebook policies. As long as shady actors seek established user accounts and users are willing to lease them, this shadow market will prosper and allow those actors to bypass platform rules.

Cite this case study:

Roman Osadchuk, “Ukrainian Facebook account-renting scheme migrates to TikTok and Telegram,” Digital Forensic Research Lab (DFRLab), December 16, 2021, https://medium.com/dfrlab/ukrainian-facebook-account-renting-scheme-migrates-to-tiktok-and-telegram-8aff251b664.