The Secret Trail of Money Behind Those Instagram Porn Bots

It's 4:17AM and ChistinaMiller21 wants to chat. Her Instagram account is private and she has just four posts and 15 followers. While her username implies she's 21, her bio says she's 24. Later, in a direct message, she'll say she's 22. Who is Chistina (no "r") Miller? She's a student from Leeds. Where in Leeds? "Hyde Park". What does she study? "Designer".

If you have an Instagram account, you also have a dirty little secret. Whether eight, 80, 280 or 80,000 people follow you, it's likely that one or two of them are women like Chistina. That is to say, they're not really women at all. They're porn bots; "22yo girls looking for some fun"; frequent users of the red-and-black "no one under 18" emoji.

Porn bots have plagued Instagram for years. We've all got so used to them flooding into our follower requests and liking our pictures that no one really questions who's behind them and what they want. Yet, in recent months, things have become more obscure. Accounts have stopped going for the obvious "name-name-number" handle, and now slip into your DMs rather than commenting directly on your photos. If an account with zero followers, zero pictures and no link in their bio DMs you a flame emoji, what are they hoping for? And who's foolish enough to give them it?

I click on the link ChistinaMiller21 sends over and am invited to "FUCK ON THE VERY SAME EVENING". Clicking the big blue box marked "Continue" redirects me to another site (that only works on mobile and not desktop) called TopGirlsHere.com. After answering a series of survey questions ("These women only desire quick sex. Not dating. Do you agree to this request?") I'm redirected again to WellHello.com, a run-of-the-mill "dating, hook up, and swingers" site that wants you to pay for "UNLIMITED ACCESS" to women.

It's a tale as old as time and a song as old as rhyme, so surely no one in 2019 is falling for it and handing over their credit card details? Yet by following the trail further and doing a little digging, I find SmoochyCash.com – an affiliate marketing website that allows anyone to sign up and share WellHello links in exchange for money. Affiliate marketing is a business model that rewards people for bringing customers to a company or visitors to a website. Just as Instagram influencers can earn cash every time someone clicks their affiliate link to a lipstick, porn accounts can make money from getting you onto porn sites – whether or not you yourself spend any money.

"There is an unlimited supply of horny single men, and you can get a pretty nice conversion rate if you know how to tease them just enough for them to click your link," says Steve Smith, owner of MakeMoneyAdultContent.com, a blog for adult affiliate marketers. Smith himself doesn't use Instagram in this way, but has encountered people who pose as women on Twitter, Snapchat and even Quora to make money through affiliate porn links.

CrakRevenue is one of the most popular adult affiliate marketing sites, and Smith says you can earn up to $5 (£3.80) for getting a single person to enter their email address in a website (this is referred to as PPL – pay per lead). Affiliate marketers can also earn commission if someone actually signs up for a site by purchasing a subscription (PPS – pay per sign-up, or pay per sale). This is much more difficult, Smith says on his website, "but not impossible".

Of course, this whole thing isn't supposed to be automated – in its terms and conditions, SmoochyCash loudly declares "COMPANY POLICIES ARE ZERO TOLERANCE FOR SPAMMING". But savvy money-makers use "black hat" techniques by making bots that spam affiliate links across sites like Instagram.

"Affiliates and bots are like peanut butter and jelly," says Satnam Narang, a senior research engineer at cybersecurity company Tenable. Narang investigated Instagram porn bots in 2016, and explains why I was redirected through a series of sites before hitting the WellHello dating site.

"I suspect part of the reason is to filter out non-qualifying leads," he says. "Certain affiliate offers specify only certain types of leads are valid – for instance, an offer may require mobile-only traffic." Narang explains some offers are also only valid from certain geographic locations, and that intermediary sites also help stop the original link getting flagged or removed by Instagram.

On BlackHatWorld.com – a self-described "forum for digital entrepreneurs with over 80 million page views per year" – users share helpful tips and tricks on how to create pre-lander pages like these ones. While Black Hat World has masses of users deploying masses of money-making schemes, a small pocket of its readers use the porn bot and affiliate marketing scheme outlined by Narang. Users recommend apps that allow you to save all the photos from someone's Instagram onto your camera roll, and also direct each other to Google Drives and Discord servers that share "packs" – photos of naked women they can use to make their accounts look authentic. Although Black Hat World prohibits discussion of it, elsewhere on the internet people sell the naked photos from these packs directly, in a process known as "e-whoring".

On a forum called Nulled, "For sale: baby shoes, never worn" has been surpassed as the saddest story in the English language. On a thread entitled "My instagram ewhoring journey! Updated daily", a user explained on the 1st of September, 2018 that they'd set up an account to e-whore on Instagram and used a bot to gain followers. On the 6th of September, they apologised. "Hey guys I won't be able to update this thread for a while, I'm going through a breakup."

Of course, most people on Black Hat World and similar forums use more sophisticated money-making techniques than just creating Instagram accounts and using bots to spam links and comments, but Smith says people who are "not so marketing savvy" continue to spam like this because it involves "zero initial investment". He also says it's a more popular method in non-Western countries, though Narang says it's unlikely there’s a giant network behind these porn bots, and the vast majority are likely operated by individuals hoping to make a "quick, consistent buck".

So are these accounts going anywhere? While Instagram has a host of automated systems to detect and remove millions of spam accounts every day (and removed four bots flagged by VICE in the course of writing this piece), Narang says it's a "cat and mouse game".

"Instagram has gotten better over the years. However, the affiliates aren’t deterred by Instagram or any other social network's actions, as they look for new ways to get around some of the automated detections," he says. "Some of these methods are simple things like using numbers instead of letters in their messages, using emojis or changing the character encoding to evade filters for certain keywords." For example, Narang explains, "sеxу" might look like the word sexy, but the letters e and y are from the Cyrillic alphabet.

Ultimately, Narang says it's up to us as users to flag the accounts – but we've also got so used to tuning them out that it's rare that we bother. While many accounts disappear within a day, they can still make money before they go. ChistinaMiller21's account is now deleted, but whoever was behind it undoubtedly lives on, ready to pose as another "lonely", "very naughty" woman who just wants some fun.

@ameliargh / martaparszeniew.com