I was referring to generated or disposable card numbers rather than stolen. maybe that is the confusion?
An concrete examples of converting a user using these types of cards for free trial abuse is a user who signed up 8 week in a row using different emails, names, IPs and cards. Nudging of these users was enabled and on trying to sign up for their 9th trial they immediately switched back to their original account and converted at full price.
There are obviously people who are doing free trial abuse for commercial gain eg. Signing up 1k accounts to get test credit cards or to resell accounts. They are not going to convert (although sometimes you can successfully convert them into affiliates)
We have seen individuals just trying to get free accounts week after week, who when nudged once pay immediately thousands of dollars even after using fake, stolen or empty cards.
These individuals think they are being cheeky and when they are 'caught' they revert to doing the right thing.
Free tier and free trial abuse is a huge problem, but also a huge opportunity.
We have seen customers where free tier abusers created 80k+ accounts in a day and cost millions of dollars. We have also seen businesses, like Oddsjam add significant revenue by prompting abusers to pay.
The phycology of abuse is also quite interesting, where even what appears to be serious abusers (think fake credit cards, new email accounts etc.) will refuse a discount and pay full price if they feel they 'got caught'
OP here, I was trying to say that these pages were behind an authwall and loading with userids from a specific user but without any of their cookies to support that auth.
This led us to believe this page was MitM rather than crawled directly (as they would not be able to impersonate the user)
Browser extension is what we originally thought for exactly the same reasons you did. We started to see some requests show up from iOS devices which didn't support extensions so that made us think MitM corporate proxies.
The diversity of cloud networks looks to be due to these being deployed by individual institutions (eg. universities, corporations etc.) rather than only run from Palo Alto Network's data centers.
We also saw slightly different configurations with different browser versions, but with the same pattern of behaviour.
That was on my list of candidates as well! Those usually have a specific user agent making it clear what they are, they appear from a companies netblock (eg. Facebook, Microsoft) and cannot access authed pages (unless the key is in the url).
In this case these appeared to be all MitM'ed pages from a security device since the key wasn't in the url and it contained userids for a specific user.
Exactly! Our library is embedding in these pages and similar to Segment or other analytics tools will get told information about user events from that state. Sometimes that state is stored in the page that is sent over the wire (eg. userid) and as such we get a request saying a particular user is on the other side of the world.
It appears this is to find threats that might have no otherwise triggered or work out is particular sites are dangerous without monitoring a users machine.
It is scary that for people in a corporate environment this could be rendering banking, messaging or any other pages contents.
The strength of a referral, the proximity and seniority of the referrer and role fit all come into play.
A strong referral by a knowledgeable person often skips that person to the front of interview queue. I have hired a number of people based on referrals from team members, VCs and previous coworkers.
Many referral systems have a how good do you think this personal really is field and often an option for "I don't know this person that well I am just referring them to say I did".
If you are asking for a referral, make it as easy as possible for the referer to make you look great. They probably don't remember all your awesome work like you do, so make sure you give them simple impactful points.
I have spent most of my career as a product person before becoming a founder and one of the things I saw was a disconnect between sales and product.
The right feedback wasn't getting to product, so the right problems weren't getting solved and sales and customer success teams weren't feeling heard or empowered to get things fixed.
I wrote this as a bit of a guide on how I have solved these problems in the past and hopefully it will help others do so too.
Found something that works well? I would love to hear about it
One thing this article doesn't mention is that if you start with a 'single-player' environment it can be hard to get people to change to 'multi-player'.
Not only because of habits, but also because people have set it up just for them and they feel they need to tidy it or make it good enough to share with others.
Having a very clear delimitation between what is a persons and what is a teams/organization is really important when moving from single -> multi.
I would love to hear what things people have found worked really well too!
Yesterday someone tried to impersonate
my company, Upollo. They cloned our site, had an upollo.tld domain and had also signed up for services under our business name.
I wanted to share how we dealt with it as apparently this is happening to a lot of companies and there isn't a good guide on how to deal with it.
An concrete examples of converting a user using these types of cards for free trial abuse is a user who signed up 8 week in a row using different emails, names, IPs and cards. Nudging of these users was enabled and on trying to sign up for their 9th trial they immediately switched back to their original account and converted at full price.