Countless Americans have woken up today (August 25, 2020) with a fake text message in their SMS inbox. This SMS text message looks like this:
[name], we came across a [package / parcel] from [month] owed to you. [Please claim / Kindly assume] ownership and [schedule / confirm] for delivery here: [link]
This scam may originate in Singapore, based on IP information.
The the text messages have been reported to contain links to the following websites:
Ad
 | Best International Crypto Exchange - Buy/Sell BTC & other Cryptocurrencies |
 | Were You SCAMMED Online? Recover Your Money Now! |
 | Crypto Betting Platform (CFDs) |
- 1smc.info
- l1smc.info
- l2scr.info
- l3smr.info
- l4sve.info
- i4sve.info (though this domain hasn’t been registered)
- l5ssv.info
- 15ssiv.info (this domain also is not registered)
If you click on the link, it will redirect you grabberdeals.icu, a page with a survey promising weight loss pills, luxury purses, watches, etc.
If you reply to the text, you will receive no response.
Phone Numbers
The text was sent from many (possibly spoofed) phone numbers, including:
- 2092702308
- 2094991589
- 2096733181
- 2134728409
- 2172865497
- 2176977125
- 2179238154
- 3212138473
- 3212947075
- 3213264930
- 3214023238
- 3215786217
- 3215786226
- 3322287612
- 3322287670
- 3322287948
- 3322287964
- 3322287999
- 3322288034
- 3322288297
- 3322288423
- 3475490915
- 3476739432
- 3477892624
- 3478033677
- 3478823593
- 3479896288
- 4012257193
- 4013265159
- 4016184214
- 4072579611
- 4079918833
- 4632068231
- 4706354388
- 5082800994
- 5082804739
- 5089013528
- 5859698041
- 6064386756
- 6076780093
- 6076780132
- 6462838317
- 6464602438
- 6465737567
- 6466590491
- 6466756528
- 6467257831
- 6572375409
- 6572742534
- 6572749914
- 6573416685
- 6574180562
- 6574785418
- 6574785420
- 6574785423
- 6574785425
- 6574785426
- 7142646638
- 7142699160
- 7142705104
- 7142709413
- 7142714640
- 7142718516
- 7142719978
- 7142721521
- 7142728445
- 7143108047
- 7143229510
- 7143256414
- 7143305971
- 7143428981
- 7143942934
- 7144253574
- 7144254593
- 7144256671
- 7144544897
- 7144544962
- 7145188229
- 7145198990
- 7146244326
- 7146420265
- 7146420555
- 7146423627
- 7146423851
- 7146423939
- 7146425673
- 7146425828
- 7146425948
- 7146428486
- 7146428571
- 7147466529
- 7162665683
- 7162665734
- 7164192512
- 7164192855
- 7164192890
- 7175377263
- 7186109174
- 7188543036
- 7188830825
- 7326665426
- 7405819082
- 7413301805
- 8482847052
- 8603890180
- 8605745786
- 8607598135
- 8609148721
- 9102069202
- 9159414096
- 9172880672
- 9173242060
- 9173559648
- 9174192916
- 9175137862
- 9175201705
- 9175456310
- 9175586960
- 9176368125
- 9176893966
- 9177053361
- 9177410145
- 9177436971
- 9177448755
- 9178266703
- 9178349824
- 9178470859
- 9178534677
- 9178621475
- 9178622831
- 9178623709
- 9178625172
- 9178629410
- 9178643837
- 9178647526
- 9178649445
- 9178649563
- 9178649671
- 9178653813
- 9178656627
- 9178680667
- 9178681589
- 9178685752
- 9178687341
- 9178688932
- 9178689574
- 9178731176
- 9178732075
- 9178739354
- 9178917234
- 9179008983
- 9179122854
- 9179123065
- 9179126689
- 9179130492
- 9179132542
- 9179133186
- 9179134285
- 9179134782
- 9179136730
- 9179137198
- 9179138144
- 9179139728
- 9179298031
- 9179301277
- 9179404875
- 9179407879
- 9179408561
- 9179416612
- 9179417096
- 9179417482
- 9179512416
- 9179513848
- 9179518042
- 9179722469
- 9179728746
- 9292088790
- 9292151779
- 9313053437
- 9316320208
- 9316378479
- 9492310674
- 9492498681
- 9492939328
- 9492941786
- 9522906382
Domain Analysis
The domain 1smc.info was registered via the GoDaddy.com, LLC registrar on January 24, 2013 for 10 years by SMC Corporation of America (Indiana, USA).
The domain l1smc.info was also registered via the NameCheap, Inc registrar on August 24, 2020 for 1 year and the identity of the registrant is also hidden by WhoisGuard, Inc.
The domain l2scr.info was registered via the NameCheap, Inc registrar on August 25, 2020 for 1 year and the identity of the registrant is hidden by a privacy service provided by WhoisGuard, Inc.
The domain l3smr.info was registered via the NameCheap, Inc registrar on August 26, 2020 for 1 year and the identity of the registrant is hidden by a privacy service provided by WhoisGuard, Inc.
Ad
| Best International Crypto Exchange - Buy/Sell BTC & other Cryptocurrencies |
| Were You SCAMMED Online? Recover Your Money Now! |
| Crypto Betting Platform (CFDs) |
The domain l4sve.info was registered via the NameCheap, Inc registrar on August 27, 2020 for 1 year and the identity of the registrant is hidden by a privacy service provided by WhoisGuard, Inc.
The domain l5ssv.info was registered via the NameCheap, Inc registrar on August 28, 2020 for 1 year and the identity of the registrant is hidden by a privacy service provided by WhoisGuard, Inc.
The domain grabberdeals.icu has the exact same Whois informaton as l1smc.info.
This analysis suggests that the 6 latter domains are owned and operated by the same person, who may be the scammer behind this scheme. Apparently, every day new domains are used, perhaps because the old ones are being blocked.
Got this message? What to do next?
These text messages may be illegal.
According to the Federal Trade Commission (FTC),
It’s illegal to send unsolicited commercial email messages to wireless devices, including cell phones and pagers unless the sender gets your permission first. It’s also illegal to send unsolicited text messages from an auto-dialer — equipment that stores and dials phone numbers using a random or sequential number generator.
To file a complaint with the Federal Communications Commission, click here.
To file a complaint with the Federal Trade Commission (FTC), click here.
If you wonder why you have received these emails and how they knew your first name (and perhaps even your last name), then you should consider that your personal information has been compromised in a data breach. To verify that, go to haveibeenpwned.com.
Received a text message saying you have a package/parcel waiting for you? It may be a SCAM! Click To Tweet
