Yet Another Text Spammer (Part Two)

Here is the original post on the topic of this text spammer.


Until recently, the email address where you were supposed to send your personal information - market.dir@o2.co.uk - did not respond to inquiries. Only the original contact email - 4882@o2.co.uk - replied to any questions.


However, that has changed with a name and a new phone number added to this story. Several days ago, a friend sent an email to market.dir@o2.co.uk with a question regarding sending his details and received a reply from a person using the name Basil Al-Haddad. "Basil" also gave a new phone number by which he could be contacted: 
 011 (44) 787-228-2424 which is also a number from the United Kingdom.

Basil Al-Haddad

Marketing Director

TELEFONICA O2 UK LIMITED

260 Bath Road Slough Berkshire SL1 4DX

England, United Kingdom.

Phone: 011 (44) 787-228 -2424

Email: market.dir@o2.co.uk

According to information I received, this new number is a cellphone. If this number is correct, you can SMS this person via one of these addresses

• 07872282424@mmail.co.uk
• 07872282424@o2.co.uk
• 07872282424@mmsc.mms.o2.co.uk

Due to my ignorance of dialing phone numbers in the UK, these addresses may not be entirely accurate. So, be careful.

Once again, an IP trace was done and surprisingly the result was the same as the email received from 4882@o2.co.uk in that the IP was out of the USA. So, my initial assumption of a ringleader being in the UK was incorrect. Either that or they are using a proxy, but I had always thought that a proxy would give a different IP every time you used it.


Examining the headers of both emails, I found this in the first

Return-Path: info3@telefonicamail.net

and this in the second

Return-Path: veunit@telefonicamail.net

I didn't think much of it, at first. But, curiosity got hold of me and I did a WHOIS on telefonicamail.net and received this result

WHOIS information for telefonicamail.net :[Querying whois.verisign-grs.com]
[Redirected to whois.melbourneit.com]
[Querying whois.melbourneit.com]
[whois.melbourneit.com]
Domain Name.......... telefonicamail.net
Creation Date........ 2010-04-29
Registration Date.... 2010-04-29
Expiry Date.......... 2011-04-29
Organisation Name.... John Russell
Organisation Address. PO Box 61359
Organisation Address.
Organisation Address. Sunnyvale
Organisation Address. 94088
Organisation Address. CA
Organisation Address. US
Admin Name........... Admin PrivateRegContact
Admin Address........ PO Box 61359
Admin Address........ registered post accepted only
Admin Address........ Sunnyvale
Admin Address........ 94088
Admin Address........ CA
Admin Address........ US
Admin Email.......... contact@myprivateregistration.com
Admin Phone.......... +1.5105952002
Admin Fax............
Tech Name............ TECH PrivateRegContact
Tech Address......... PO Box 61359
Tech Address......... registered post accepted only
Tech Address......... Sunnyvale
Tech Address......... 94088
Tech Address......... CA
Tech Address......... US
Tech Email........... contact@myprivateregistration.com
Tech Phone........... +1.5105952002
Tech Fax.............
Name Server.......... ns1.officelive.com
Name Server.......... ns2.officelive.com

Doing a reverse WHOIS reveals that "John Russell" owns hundreds of other domains. However, it would cost me a lot of money to find-out which domains they are and I do not care about it that much to spend money on this. So, it seems that "John Russell" is behind this whole thing.


Other email addresses used in the past with this scam:

• veunit@o2.co.uk
• inquiry@o2.co.uk
• query1@o2.co.uk
• info@o2mobile-uk.com

I'm sure that I could find more addresses, if I was inclined to keep looking.

Apparently, the scam got started in Nigeria with these text messages being sent out randomly with all correspondences being done by email. The addition of real telephone/fax numbers shows that it is possible they have confederates in the UK working as part of the scam.

Duane Browning

Yet Another Text Spammer

I received this text message on my cellphone right after I had finished breakfast yesterday morning

From: noreply@o2.co.uk CongratulationsYou've been awarded 418,000 British Pounds by Telefonica O2. Send an Email to 4882@o2.co.uk for claims

So, I sent a reply from the email account I use for responding to text spam and I received this message the next day: 

From: "O2 Mobile" 4882@o2.co.uk
Ref: O2/1629/11
Dear winner,
I congratulate you on behalf of the management of Telefónica O2 UK Limited. This promotion is brought to you as a marketing strategy designed to create an awareness of the expansion of O2 network coverage to the North American region.
23 cell phone numbers were randomly selected worldwide via a computer draws system. Your number was selected from the 2nd category in the 1st draw, hence made you a silver award winner.
To facilitate the redemption of your award, kindly contact the Marketing Director with the following details:
First and Name:
Contact Address/Tel:
Email:
Age:
Occupation:
Winning Phone Number:
Amount won:
Send information to Email: market.dir@o2.co.uk
Upon receipt of the above information, the marketing director will verify the details to ensure you are the registered owner of the winning phone number. Once these formalities are concluded, your funds will be remitted to you. Be assured that your details are highly secured. It will neither be disclosed to third parties nor used for illegal activities.
TERMS AND CONDITIONS
1) Any falsification of your details will render you disqualified.
2) Friends or relatives are not eligible to receive award on your behalf.
3) To avoid multiple claims and impersonation you are expected to respect the integrity of the privileged information regarding your winnings, do not disclose to third parties until your prize money is received by you.
4) After you receive your award, you will be required to honor an invitation to join Telefónica O2 marketing team on TV for an interview regarding this promotion in North America.
Please advise how convenient this interview will be for you. Congratulations once more and thank you for being part of our expansion awareness program.
Best regards,
Promo Co-ordinators.
TELEFONICA O2 UK LIMITED
MARKETING DEPARTMENT
Office: 011 (44) 127 479 2353
Fax: 011 (44) 191 247 8151
260 Bath Road Slough Berkshire SL1 4DX
United Kingdom

IMPORTANT NOTICE: This electronic message contains information from Telefonica O2 UK ltd which may be privileged or confidential. The information is intended to be for the use of the individual(s) or entity named above. If you are not the intended recipient be aware that any disclosure, copying distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by email.

I would have figured that would have come out of Nigeria, China or someplace like that. But, no, it came from within the USA. A simple IP trace was all that I needed to do to discover this.

Obviously, this is a scam. So, I forwarded the message I received to O2's corporate offices in the United Kingdom for them to take whatever action they deem appropriate.

While the address given in the email is Telefonica's real address, the phone numbers don't match. The phone numbers are from Great Britain, but they are not Telefonica's. From another blogpost, I learned that if you call the numbers, somebody actually does answer the phone and they even give you a tracking number for whatever package they are supposedly sending you.

So, this isn't some slapped-together scam, these guys have a pretty convincing swindle going here and I think many people might be taken-in by them, due to their appearance of legitimacy. Due to the IP trace and the real British phone numbers, I came to the conclusion that this is actually a group of scammers working together with members on both sides of the Atlantic.

UPDATE: if you've received the first message, but the email address is different, please let me know by posting a reply to this blog. I'd like to update this blog with current information as it becomes available to me. A second post on this topic has been posted.


If you live in the United States, you may file a complaint against the sender of this text spam by going to this webpage
https://esupport.fcc.gov/ccmsforms/form1088.action


Duane Browning