Showing posts with label SMS Spam. Show all posts
Showing posts with label SMS Spam. Show all posts

Wednesday, August 13, 2025

Chinese SMS Spammers Go Mobile

CommsRisk once more has a story today about how Chinese organized crime is recruiting people online to drive around with SMS Blasters installed in their vehicles. 

https://commsrisk.com/thais-caught-with-smishing-sms-blaster-say-chinese-boss-paid-75-per-day/

In many countries, notably NOT the United States, government telecom regulations has made a significant impact on scammers by blocking the scam and fraud campaigns being sent via SMS messaging.  The response to these blockages has been the use of mobile base stations.  The technique turns a vehicle into a mobile cell phone tower, allowing it to send SMS messages directly, bypassing cell phone company's ability to block the messages. But the downside is that, depending on the power used, there is a limit to the range from 100 yards to a couple miles. 

In this case, the scammers were recruited in a Chinese WeChat channel where they were contracted by the scammer and trained how to install and set up their mobile station, which they installed in a small Mazda.  Their rig was on the low end, with a limited number of SIM cards, but was still able to send 20,000 SMS messages per day.

In November 2024, the Thai Royal Police picked up a much larger rig that was operating from a van being driven by a 35-year old Chinese national, Yang Muyi.  This device sent over a million messages in a three day period before being seized by police, as revealed in a press conference by Police Lt. General Thatchai Pitaneelabut.

Image from ThaiExaminer

Thai police have been greatly assisted in their investigations by a partnership with AIS (Advanced Info Systems) who have been helping them locate the false base stations. The image below shows the rig seized in a Honda CRV in January 2025 driven by two Chinese men, aged 47 and 49.  Police then went to the apartment where additional mobile phones, SIM cards and other telecom equipment was seized. 

Image from TheNation

On 10JUL2025, the Royal Oman Police shared a high-production quality video PSA on their Facebook, X.com, and Instagram channels warning about a Chinese tourist arrested with a vehicular-borne SMS Blaster case being used to send messages claiming to be from a local bank!

https://x.com/RoyalOmanPolice/status/1943369135477657693

Telecom Fraud expert Eric Priezkalns regular writes about this emerging technique and his map at CommsRisk showing details of more than 50 similar cases provides the most comprehensive information about such cases. 

https://commsrisk.com/fraud-dashboard/#baseStationsSection

One of the UK-based cases above happened in June 2025, with the investigation beginning when a local police officer received an SMS message claiming to be from HMRC - His Majesty's Revenues & Customs - the UK tax office. Their investigation identified Chinese student Ruichen Xiong who had been driving around London with a generator and an SMS blaster in his vehicle.

Image from The Guardian

"Captured SMS Blasting" 

The use of "captured SMS blasting" started in China where local advertisers used the technique to push advertisements for their store or services only to phones that are physically close to their location.  But scammers quickly realized there was a far more lucrative market by using the service to drive calls to fraud call centers!

The "3" over Beijing, China in this map actually goes back as far as 2014.  One of those three is a story from 2014 about Beijing police making 1,530 arrests and seizing 2,600 SMS Blasting devices! Already then, several of the text messages were imitating financial institutions, claiming a phone was infected with malware, or that their AliPay password had been changed.

Image from IBTimes

Because of the range limitations, scammers have frequently targeted places where crowds congregate.

If the problem comes in large crowds, perhaps the answer is ... 

Crowd-Sourcing Rogue Base Stations Identification

What can be done to detect and refer more of these cases to law enforcement?  The Gold Standard would have to come from Radio Yakuza! After noticing that his phone had a 2G connection to a fake base station, "Radio Yakuza" decided to investigate the situation.  He ended up recruiting a small army of volunteers on social media who reported incidents of fake base station capture and helped him to map out the possible locations.  In his initial break-through case, he was actually able to track the false base station to a black Audi hatchback!  The car was observed several more times by his team of volunteers, who noted that the driver had swapped the license plate!  His team was even able to help him get photographs of the equipment in the back of the car and demonstrate that the gear was identical to that shown in arrest photos in Thailand. 

https://x.com/denpa893/status/1911755963516014940



As with all the best reporting on this topic, the most detailed story comes from Eric Priezkalns on CommsRisk: "Amateur Detectives Find More Fake Base Stations in Japan" 

Radio Yakuza ==> https://x.com/denpa893

In a troubling example that Eric reports on, (See https://commsrisk.com/amateur-sleuths-plot-route-of-tokyo-sms-blaster-and-other-news-about-fake-base-stations/ )  one of Radio Yakuza's most recent discoveries involved a base station that was circling the Imperial Palace during Japan's recent Senate elections.  

https://x.com/denpa893/status/1946887928380367291

As Eric points out, the idea of mobile SMS Blasters being used for political mischief has also been observed in the Philippines. Maria Ressa's The Rappler.  Last month, their headline was "Spoof, smear, sabotage: How disinformation marred Cagayan de Oro’s 2025 polls."  One example they showed was an SMS campaign that claimed if people came to one politician's rally, they could show their copy of the SMS messages to receive 50,000 Pesos! (That candidate, Lordon G. Suan, went on to win his Congressional race.) 

(I can't mention The Rappler without begging you to read Maria Ressa's book, which I reviewed in December 2022 ==> 




Saturday, June 01, 2019

SMS Phish? Amazon Reward!

Are you getting text messages about winning prizes at Amazon?

I got one today with the following text from a VOIP-to-SMS number: 1 (410) 200-910

The text was:
 "FRM: You have a New Amazon Reward! MSG: http://dmkr3h.com/njngyw"

I threw up a Virtual Machine to check the destination, and got a meaningless echo of the domain name:



The problem, of course, was that they knew I was supposed to be on a cell phone, since they sent me an SMS.  No problem.  Let's make my Windows Chrome Browser a Cell Phone: 

Ok.  Now I'm a Firefox browser on an Android Mobile phone.  Let's try again.  Much better!  The CloudFlare hosted "dmkr3h" now forwards me to "simple-clubs.com" which is a CNAME alias to "seempts-explegal[.]com (35.169.148.30) " which passes my origin and affiliate data to chargingmilkshop[.]com (51.75.46.9), which forwards me to "winopinions[.]com (51.75.46.11)" which shows me this!


Before I take my Survey, I hit my "Back" button, just to see what happens, because often there are traps about such things.  Sure enough, hitting the "Back" took me to an ad totally unrelated to my Amazon Prize:


As much as I'd like to be Ketogenically Accelerated, I decided to go back to my original URL from the phone.  This time I landed at "ZoneOpinions[.]com" instead of WinOpinions, but since I was still on the same IP address, I decided to keep going and take the survey this time.  Here are my five Survey Questions:






OK, now for the excitement!  My big Amazon Reward is about to be revealed, right?





Hmmm... do I want a larger penis, a flatter belly, or a $780 watch?  I think I'll take the $780 watch, since its free and all ... 

Each time I click "Claim Reward" I get sent through a "1592track[.]com" redirector:
Which then forwards me to one of its randomly selected possible fulfillment domains ... 

getemergencygear[.]com
Odd.  Clicking on the watch takes me to a site for a free Tactical Flashlight. Oh well.  The point of this exercise is to feed some of my spam traps anyway.  We'll give them one of our spam trap email addresses just to see what they begin spamming to me. 

I wonder if ClickBank is complicit in these scams?
Since I'm not actually going to give them my credit card information, I'll see whether I get the same spam by submitting my address info for CBD Oil and Male Enhancement anyway.  Where do those clicks take me?
tryhealthoffer [.] com 


(a closer look at the Affiliate ID = 600080)

healthchoicev2 [.]com selling Primacin XL 


I saved which Spam Trap email I fed to each of the sites above.  If I start getting spam on them (none of them have existed before an hour ago and have never received any message prior to being fed to these sites) I'll do a follow-up post.

While trying to decide if this is something to share with my friends at the Federal Trade Commission, I decided to check what country these domains are hosted in ... Poland ... 

ipinfo.io/51.75.46.9 ==> OVH SAS in Poland.
According to the very useful tool at RiskIQ, it looks like 77 new domains stood up on this IP address about two days ago:
https://community.riskiq.com/search/51.75.46.9
We went ahead and exported that list so we could save a record of what other domains were there.  Looks like there are MANY alternative domains for doing the same sort of things ... 


resolvefirstSeenlastSeen
actionopinion.com5/30/20195/31/2019
airopinions.com5/30/20195/31/2019
alertandfocusednow.com5/30/20195/31/2019
alertandsharp.com5/30/20195/31/2019
blazingtea.com5/30/20195/31/2019
brainexpandnow.com5/30/20195/31/2019
brainexpandtoday.com5/30/20195/31/2019
brainexpandtonight.com5/30/20195/31/2019
cellopinion.com5/29/20195/31/2019
centeropinion.com5/30/20195/31/2019
chargingmilkshake.com5/30/20196/1/2019
companyopinions.com5/30/20195/31/2019
connectexclusive.com5/25/20195/31/2019
corpprogram.com5/30/20195/31/2019
dataopinions.com5/30/20195/31/2019
dreamopinions.com5/30/20196/1/2019
exclusivetrendingreport.com5/25/20195/31/2019
fitketonow.com5/30/20195/31/2019
fitketotoday.com5/30/20195/31/2019
fullyhardagain.com5/30/20195/31/2019
fullyhardtonight.com5/30/20195/31/2019
hardandlongagain.com5/30/20195/31/2019
hardandlonger.com5/30/20195/31/2019
hotbreakingreports.com5/30/20195/31/2019
hotnewstonight.com5/30/20195/31/2019
hotviralreports.com5/30/20195/31/2019
latestbreakingreport.com5/30/20195/31/2019
latestviralreport.com5/30/20195/31/2019
learningopinion.com5/30/20195/31/2019
lineprogram.com5/30/20195/31/2019
linkopinions.com5/30/20195/31/2019
linksprogram.com5/30/20195/31/2019
longandhardagain.com5/30/20195/31/2019
longandhardtonight.com5/30/20195/31/2019
longerhardernow.com5/30/20195/31/2019
lookprogram.com5/30/20195/31/2019
lumberingsoda.com5/30/20195/31/2019
magicopinions.com5/30/20195/31/2019
matchopinion.com5/30/20195/31/2019
maxopinions.com5/30/20195/31/2019
mindexpandnow.com5/30/20195/31/2019
monsterprogram.com5/30/20195/31/2019
newbreakingreport.com5/30/20195/31/2019
newbreakingreports.com5/30/20195/31/2019
newtrendingreport.com5/30/20195/31/2019
newtrendingreports.com5/30/20195/31/2019
newviralreport.com5/29/20195/31/2019
portalopinion.com5/30/20195/31/2019
projectopinions.com5/30/20195/31/2019
romanwatermelon.com5/25/20195/31/2019
rushingcoffee.com5/30/20195/31/2019
saveopinion.com5/30/20195/31/2019
shesreadytonight.com5/30/20195/31/2019
shoppingopinions.com5/30/20195/31/2019
slimketonow.com5/30/20195/31/2019
slimketotoday.com5/30/20195/31/2019
slimketotonight.com5/30/20195/31/2019
slowseltzer.com5/30/20195/31/2019
sluggishjuice.com5/29/20195/31/2019
sprintingspirits.com5/30/20195/31/2019
swiftespresso.com5/30/20195/31/2019
teamopinions.com5/30/20195/31/2019
thenewstrends.com5/30/20195/31/2019
tightketonow.com5/30/20195/31/2019
tightketotoday.com5/30/20195/31/2019
tightketotonight.com5/30/20195/31/2019
todaysbreakingstory.com5/25/20195/31/2019
tonightsbreakingstory.com5/25/20195/31/2019
totalbreakingnews.com5/30/20195/31/2019
touchopinion.com5/30/20195/31/2019
trendstonight.com5/30/20195/31/2019
whirlingmilk.com5/30/20195/31/2019
winopinions.com5/30/20196/1/2019
yournewsbreaks.com5/30/20195/31/2019
yournewstrends.com5/30/20195/31/2019
zoneopinions.com5/30/20195/31/2019
zoomingcider.com5/30/20195/31/2019

Many of these domains are proven to be interchangeable, as long as your user agent is right. Pasting the "path/file/parameters" from one site to another of the same type usually works.

Conclusion?  Don't think I'm going to get my Amazon Prize.  Darn.