I left a comment in the thread. Feel free to ask questions. Though, I'm cautious about giving too many details as I plan to report the guy to the AG in his state.
No blog post. But, since you and another have requested I'll just write a comment.
I work for a small, local, family company. I maintain the websites and do some of the marketing.
We've noticed an uptick in websites for fake businesses and fake business listings in our area/industry in the past 3-4 years. The goal is to generate leads which can be resold to local contractors--usually without the customer knowing. It's a scheme called "rank and rent."
A few months ago, I noticed a new listing in our area. I started digging into the SEO spam for it. There was a website, a couple of one-episode podcasts, social media profiles, business listings, PDF spam, and more.
Looking into the HTML source of the site, I discovered some JSON-LD for a completely different company. I looked up the company on Google Maps. Sure enough, there was a listing. And the website was using the same theme as the one I was digging into.
I decided to pull the DNS records. They both used the same Cloudflare NS. Not a smoking gun, but interesting. Then when I pulled the TXT records, I noticed both used the same IP for the SPF record. Bingo!
A quick cURL resolving the domains to the IP, and I had proof they were hosted on the same shared hosting server.
With the IP, I was able to do a reverse lookup for other sites hosted on the same server. This netted me several domains that also used the same theme and had Google Maps listings (GBP). The money result was several marketing firm domains.
One turned out to have a GBP. It had videos and photos the person used to verify the listing. Fortunately, it had the marketer speaking in the video as well. That voice sample allowed me to compare it to the podcasts mentioned above. Aside from him faking an accent, it was definitely the same guy. I've since discovered ~30 such podcasts for his different listings.
The other marketing domains were even more interesting. They were also run by the same guy. Again, verified via voice in a video on these sites. He used these websites to recruit people for "social media gigs." The gigs were setting up Google Business listings in their area. They'd setup a listing, get the postcard with a verification code, pass it off to the marketer, and he'd pay them $50-100.
The kicker was a Google form on the recruitment page. It asked if the person would be willing to leave 5-star reviews for businesses they'd never done business with for $20.
I went back to Google Maps and started bouncing through people who'd left reviews. That opened up a whole world of listings that I hadn't known about.
At present, I'm over 80 listings which can be tied back to him.
I've also identified several websites that don't have GBP listings yet thanks to the TXT records and reverse lookups.
TXT records are useful for OSINT. I've used them to tie together fake business listings on Google Maps. It also allowed me to tie the listings directly to the marketer responsible.
I appreciate email as a marketing channel. I sign up for several newsletters. I read them sometimes. I don't at others. If I find they offer nothing of interest or value to me, I unsubscribe. If I continue receiving emails after unsubscribing, then we have a problem.
I rarely have issues with companies which actually abide by things like the CAN SPAM Act.
The most famous case is locksmiths.[0] Google recently went after another company using the "rank and rent" scheme.[1]
The company which is causing us issues is also using the "rank and rent" scheme. They're running listings for everything from pool resurfacing to concrete driveways to tree services.
The company recruits people via Craigslist with an offer to pay them $50-100 to setup a Google Business Profile and receive the post card with a code for verification. They also offer $20 for a 5-star review.[2]
I am thinking about going to the FTC and the media at this point. I've also discovered that there's a small community but poorly connected that goes after this type of spam.
The power Google has over small, local businesses is ridiculous.
I work for a small local business. We've been struggling to get rid of the "lead generation" spam from the Google Maps listings. This is costing us on the order of thousands to tens-of-thousands a month in work. (That's significant for our business, on the ~10-15% of monthly revenue.)
I dug into these listings. I discovered the company behind them, a marketing firm in Hawaii. I uncovered a network of 80+ listings across the US they operate. I even discovered their recruiting websites where they pay people to create the listings for them and go on to pay people for 5-star reviews.
I provided all of this information to Google via their "business redressal form." Nothing. It's been months. I keep reporting the listings. Nothing.
We're losing work. Other local contractors are losing work. And Google twiddles its thumbs.
What good is it for Google to have a policy if they're not going to uphold it when their inaction is harming others?
This misses the point. The issue is not whether or not Google/Facebook should be classified as data brokers or not. The issue is that they are data collectors who invade our privacy.
I want the means to tell companies "Do not collect information on me." And I want that to be enforceable by law.
The legislation appears to be limited to data brokers. While this is nice and welcomed, this also means it doesn't cover entities like Google or Facebook.