While hunting for novice hackers I came across a fake game gold generator, which was instead of spreading malware used to trick people into doing CPA offers. Just before the generator would generate the gold, it asked for human verification. Inspecting the code, after completion the generator would just output an error message while the creator would rake in money. In a sense the owner of the site is 'making a contract' with the visitor to deliver something if the visitor completes an offer. My questions are: Is this kind of trickery legal? The CPA network in question is CPAGrip, should I report the id? Will they even care? What are the chances the feds will look into this?