Hong Kong’s Zorpia: Is This a Real Social Network or Just a Spammer?

I first came across Zorpia a couple months ago, when I got an email saying that a friend — we’ll call him Mike — had “left me a private message” on the service. That seemed unlikely, but I wrote it off as random spam and forgot about it, until last week when I got a similar email, ostensibly with a private message from my wife. My mother got the same email. I checked with my wife, who admitted she’d clicked a link in an email from Zorpia, but denied ever having set up an account, let alone sent any private messages. Something seemed very odd. I vowed to dig deeper.

Zorpia, it turns out, is a startup founded and run by Jeffrey Ng and based in Hong Kong. Launched all the way back in the early days of MySpace, Zorpia began as a social network that would facilitate unlimited photo sharing. Over time, Ng says, it has evolved into a service that’s more focused on helping people make new friends (he likens it to a digital bar or a town hall). It has also built up a very substantial base of registered users, growing from just 1.5 million users in 2005 to around 28 million users today, although just one million are monthly active users. Most of those users are in Asia, Ng tells me, and the service is especially popular in India, with over ten million registered users.

When I asked about user acquisition, Ng told me the site used a variety of techniques, mostly based around people inviting their friends. I explained about the emails I had gotten from my friend and my wife and asked Ng to explain why I was getting messages from people suggesting they had left me private messages on Zorpia when they clearly hadn’t. He told me he’d look into it, and but was never able to satisfactorily explain how that had happened.

To get to the bottom of things, it was clear that I needed to sign up for a Zorpia account myself. And so I did. As with all test accounts that I create for work, though, I used none of my real information, opened the account via a browser I don’t normally use, and registered using a unique email address created specifically for that test account.

Things looked bad pretty much immediately. On the account activation page, I noticed that three hyperlinks users might expect would lead to help pages or a “resend email” prompt actually redirect users to sketchy free-survey sites that seem an awful lot like scams.

(Ng confirmed that the links are there intentionally as advertising, but said that Zorpia has no control over what the links lead to as it varies based on the user’s geographical location UPDATE: Ng says that he was referring to the site’s banner ads, and that there should not be text-linked ads on the authentication page. “We simply do not understand how those links could appear on the screenshot you provided unless there was tampering,” he says. However, as evidenced by the screenshot above, they did appear when I activated my account.)

Once I logged in to my new account, I found another surprise: Zorpia was worried about my password security. A banner across the top of the screen blared that my password was “more than six months old.” Given that the password is one I’d never used before and had created only moments before, I was not expecting this. (Ng told me the message appeared to be a bug; however, as of this writing it has not been fixed UPDATE: Ng says the bug is now fixed.). But I ignored it because as you can see in the screenshots below, I had two new messages.

When I opened my messages, one of them was the boilerplate welcome greeting you’d expect from the Zorpia team. The other was an absolute shock. There sitting in my inbox just a minute after I first opened this account, was a message from my real life friend “Mike”: