NordVPN researchers discovered a large network that used Facebook and Instagram for years to promote gambling offers via fake Google Play pages. According to the report, the infrastructure was named pwa_betterlinks. It included thousands of ad pages, whitepages, and landing pages impersonating well-known brands.
The key feature of the scheme is that it was not a one-off setup by a single team, but a turnkey service sold to other media buyers.
How the Scheme Worked
For instance, a user would see an ad in their feed for Google Authenticator, Disney+, or another popular app. Upon clicking, they landed not on the real Google Play store, but on an almost identical replica.
Then came the most interesting part. While Meta's moderation team checked the whitepage, real users were directed by cloaking to the fake app store. After clicking the "Install" button, a PWA application was downloaded to the phone instead of an APK file, looking almost indistinguishable from a standard Google Play app.
A familiar icon appeared on the home screen, after which the user started receiving push notifications featuring bonuses, free spins, and deposit offers.
Simply put, instead of installing an app from Google Play, the user added a web application to their phone that looked virtually identical but was entirely controlled by the setup owners.
Why PWAs Proved Convenient for Gambling
The main advantage of PWAs is independence from Google Play.
Media buyers did not need to publish the app to the store, go through review processes, or worry about developer account bans. Everything operated via their own domains, and communication with the user continued through push notifications post-installation.
That is precisely why PWAs have remained one of the popular tools in gambling and betting for several years.
What Was Sold to Buyers
According to NordVPN, pwa_betterlinks was distributed as a turnkey subscription service.
It included pre-configured tools that typically have to be set up separately:
-
generation of fake Google Play pages;
-
built-in cloaking;
-
a TDS for traffic distribution;
-
push notification delivery following PWA installation.
In effect, buyers received a ready-to-run setup for launching ad campaigns rather than a standalone tool.
What This Means for Media Buyers and the Market
Studies like this rarely go unnoticed. Following the publication of the report, Meta will almost certainly begin inspecting setups that utilize fake Google Play pages, PWA applications, and similar cloaking schemes much more closely.
This could primarily affect landing pages that replicate the Google Play interface, as well as domains featuring similar design elements.
If your setup relies on PWA pre-landers styled like Google Play, it is worth checking in advance how closely they resemble the original. The more accurately the official store interface is copied, the higher the likelihood of additional checks following the report's release.
Those working with PWAs should also pay closer attention to whitepages, cloaking, and the visual assets of pre-landers and landing pages. After investigations of this scale, these elements are typically the first to come under scrutiny.
