Guerilla marketing: German outdoor advertiser put up posters for online shop that sells drugs

Wir haben diesen Artikel auch auf Deutsch veröffentlicht.

Criminals have succeeded in putting up posters for a dubious internet shop via a large outdoor advertising company in several German cities. The product range includes cocaine, credit cards and accounts at Tinder. To spur guerrilla marketing, an operator disguised himself as an outraged citizen and sent e-mails to the press. In this way, several outlets owned by the media organization Funke-Gruppe fell for the fraudster.

Perhaps Markus V. simply made a mistake in the end. In any case, the e-mail he sent to netzpolitik.org on Thursday was hardly correct. „I saw a QR code on a billboard today and scanned it. It directed me to a website that sells drugs online,“ he writes.

The poster shows a person wearing a Guy Fawkes mask with a rose in his hand, accompanied by the words „Everyone wears a mask. But who is behind it?“. After all, the QR code described by Markus V. is genuine. It actually leads to a shop with a .to address. In the shop you are first asked for the desired language and then whether you want to buy „everything“, „drugs“ or „accounts“.

A tip from an outraged citizen?

The shop plays with Anonymous optics and drug dealing clichés. In addition to various drugs such as weed and cocaine, eBay accounts and credit card details are also offered for sale. You can pay with digital currencies like Bitcoin or with prepaid cards. In order to give it a professional look, the website even has a privacy policy and general terms and conditions.

The alleged whistleblower, who is probably not really called Markus V., seems to be angry. He can’t believe that criminals can simply advertise for forbidden things, he tells us in the conspicuously naïve e-mail. He also tells us the exact address where he claims to have seen the poster in Berlin.

Markus V. goes one step further. He wants to provide proof that he is telling the truth. „I have enclosed a photograph that I took.“

The address he gives us is on a big road in Weissensee, a district of Berlin. It’s not a very pretty corner, it’s mostly gas stations, discount stores or car dealerships. What does not exist are the old buildings, which can be seen on the picture that was attached to his email. The street signs on the picture are blue and white and not white and black like in Berlin. And there are also cars with license plates from the Ruhr area.

It becomes clear quickly: the picture was actually taken in Oberhausen. Is it possible that Markus V. sent us the wrong photo?

„I hope you can help me to get this poster taken down again and the perpetrators put in prison,“ he writes netzpolitik.org. He claims, he also informed the authorities, but they were not interested in the case.

The same text will also be sent to other media outlets, including the tabloid website DER WESTEN, based in the Ruhr area and there, a local reporter immediately sets to work. His article appears as early as Friday afternoon: „Man sees mysterious advertising poster – when he looks at it more closely, he immediately calls the police,“ shouts the headline in best clickbait style.

The text then says that Markus V. regularly passes the advertising space while jogging. „The mysterious poster quickly became a topic of conversation in the neighbourhood. It also caught the attention of Markus V.“

DER WESTEN and WAZ fall for Markus V.

The newspaper WAZ also reports the story and it also believes Markus V.’s role of the outraged passerby. A journalist from the local editorial office tells netzpolitik.org that he received the man’s e-mail and thought he was a reader. The article „Poster in Oberhausen advertises drug trafficking with terrorist“ appears on Friday afternoon. Apparently the author is referring to the Guy Fawkes mask. Guy Fawkes had tried to blow up the English parliament in the 17th century.

Shortly afterwards, when we inform WAZ about the inconsistencies surrounding Markus V., the newspaper changes the headline. Now it reads: „Advertising poster in Oberhausen trickily advertises drug purchase“. This describes more accurately what happened.

According to the metadata of the image file that Markus V. sent to netzpolitik.org, the photo was not taken on Thursday, but already on June 5th. That’s how long the sinister poster with the Anonymous portrait seems to have been on display in Oberhausen. Yet no one had apparently been interested in the motif before. Maybe nobody had scanned the QR code. Even the police in Oberhausen only found out about it on Friday morning when the press came forward and asked questions, says their spokesman Maik Podlech.

Police investigates the case

In the meantime the poster has been removed. The Koblenz outdoor advertisement company AWK had put it up, as a spokeswoman admits on request. The company had researched the client on the internet and found nothing offensive. „In addition, we can inform you that our specialist department has examined the motif.“

But did the company also check the QR code and the internet address hidden behind it before putting up the poster? A question that AWK leaves unanswered. It’s not the only one. Additionally, there are now indications that the problem for the company could be much greater than initially assumed.

netzpolitik.org confronted Markus V. with the false information in his e-mail. When asked, the person, who communicates via a Web.de address and who was just an outraged citizen, hints at a possible participation in the Internet shop. He also claims, however, that the motif was posted at six other advertising spaces, including in Berlin on an advertising wall of the same company at the address in Weissensee. The press office of the Berlin police did not comment on this on Friday evening.

The shop owners claim to have paid 250 to 300 euros per poster. According to them, the motif was also on display in Dortmund and Hamburg. AWK also operates advertising spaces in these cities.

Outdoor advertiser AWK reacts thin-skinned

netzpolitik.org also asked AWK where else the company had placed the ad. But the company also left this question unanswered, allegedly for data protection reasons. A spokeswoman reacts thin-skinned to inquiries. „Any comments on your part concerning our company must be authorized by me and our legal department,“ she warns by e-mail.

In contrast, the shop operators were hoping for press coverage. That is why the media has been made aware of the campaign, writes Markus V. in an e-mail to netzpolitik.org. „Other shops try to establish themselves laboriously, whereas [name of the Shop removed] does exactly the opposite.

Meanwhile the criminal investigation department in Oberhausen is looking into the case. They suspect a trace to Tonga, an island state in the pacific, because of the domain. A trail that is unlikely to provide the investigators with useful information: The domain of the shop was registered via an anonymization service.

Tonga domain

Websites that offer drugs are not unusual. However, most of them are operated on the Darknet, which makes prosecution difficult. It is rather unusual that they can be accessed via the so-called Clearnet, like the now advertised shop. For most operators, the risk to which they and their customers are exposed is too high.

A website, that we are not mentioning here because it gives away the domain of the shop, quotes the shop owners with the pompous claim that they have been active in the scene not only „since yesterday“. According to an investigation by netzpolitik.org, the people behind it apparently still made a mistake.

To disguise the true location of the server, they use the service Cloudflare. According to a domain database, however, the domain still led to an IP address in Stockholm on June 5th – the day when the photo seems to have been taken in Oberhausen. It belongs to the provider Njalla, who also offers web hosting in Sweden. The web server, which the shop owners may have rented there, went online at least three weeks ago, as an old SSL certificate reveals.

Advertise the shop with guerilla marketing

It is unclear whether drugs and other illegal goods are really sold in the shop or whether the operators want to earn money only by cheating potential customers. Anyone who orders products on the website will be shown a Bitcoin address to which they should transfer the respective amount. At the latest after the transaction, this is a criminal offence.

The following process seems the most likely: The original plan of the shop owners, to initially attract attention for the shop on social media with real poster advertising, did not work out. Apparently nobody is looking at QR codes, possibly not even the outdoor advertising company AWK, on whose surfaces the poster was put up. When the owners of the shop realised that their campaign was about to fail, they wrote naïve e-mails to journalists. Several publications fell for this, one medium even mentioned the name of the shop – and thus did exactly what the owners wanted to achieve: to promote their business.