Matt Haynes - Programming & Tech Blog

Thought some spam comments on my site may be why it’s being listed as “harmful” in Google. Then I noticed they’d just gone crazy. Quite funny.

I came across the “auction” site swoopo.co.uk and promptly wasted an afternoon and a tenner on what some may describe as a scam. Swoopo offers users the chance to grab some amazing bargains, for example some lucky user got this EEE PC for £4. What’s not such a bargain for all the users that don’t win is Swoopo’s revenue model.

The premise behind the site is “pay to bid”, with each auction bid costing 50p. Unlike a conventional auction where you bid the amount you are willing to pay for an item, a Swoopo bid will only increase the current auction price by around 7p, and also increase the auction time by 10 - 20 seconds.

Speaking from my own experience the situation for most users will go something like this. You place a bid for the item you’d like in the last few seconds, this will increase the current price by a very small amount, and also increase the time left by 20 seconds, that’ll cost you 50p. This process will go on until either all bidders have ran out of credits and one lucky bidder wins, or the auction end date comes around - which seems to be 30 days in the future.

For the users Swoopo seems to be nothing more than a lottery. It can only ever be chance that dictates who wins and loses - that or an endless amount of bid credits (money). For Swoopo and the team behind it the site must be a gold mine. Here’s my breakdown of the XBOX 360 auction I was bidding on:

My Swoopo XBOX 360 Auction:

Auction start price:

£00.00

Auction end price:

£73.99

Each bid increments the price by:

£00.07

Each bid costs a user:

£00.50

Total bid revenue for Swoopo:

£528.50

Total auction revenue for Swoopo:

£602.49

So, just to explain my maths in-case I’ve got it wrong - I figure there were 1,057 bids (£73.99 / £0.07) each costing 50p, which amounts to a whopping £602.49 (£528.50 + £73.99) sale price for an XBOX 360!

Somebody at Swoopo is making a fortune out of this. To be fair to the company they are quite clear and upfront about how it works but I do feel that billing it as an auction site is still a little misleading. The site has already raised a few eyebrows, with quite a few people pointing out the pitfalls of the site.

Personally I’ll put this one down to an interesting but financially detrimental way to spend a few hours online. I’m a little annoyed that I fell for it but then again if you’d known my betfair history you’d have probably seen it coming.

Just been playing around with a free trial of an SMS gateway service. There are loads of these services about, all seeming to offer reasonable prices to send and receive SMS messages.

The service I used had a pretty simple HTTP API which I was hacking about with to send RSS stories to my phone. I’ve previously thought about setting up a service like this - providing up to date football scores to fans. The technological costs involved are pretty much non-existent, as all it would take is a few scripts and a database to tie the thing together. However I got scared off by the sales rep’s from PA Sports when I started looking into licensing their data. It all started to look a bit too much like a real business proposition for me to get involved with in my spare time!

One of the interesting things I noticed about the SMS Gateway’s API is that it allows you to set the sender ID, as in the phone number of the message sender. This allowed me to send a message from the gateway that appeared to have originated from my phone. Unlike email spoofing where it is fairly easy to determine the actual originating sender from studying the message header, I could not find any way of detecting this forgery on my mobile!

This technique is known as SMS Spoofing and is fairly commonplace. For example Skype sends messages from its users with the mobile number they registered with. The cool but scary thing is just how easy it is to do using an SMS gateway. Like email spoofing this technique is easily abused, but perhaps SMS spoofing is all the more dangerous due to it being harder to detect and far less prevalent?