Who is +61 478 888396? SPAM warning

Forums › Off topic › Who is +61 478 888396? SPAM warning

ANglEAUT

2320 posts

Uber Geek

Trusted

Lifetime subscriber

#280256 4-Dec-2020 10:33

Received an SMS this morning from +61478888396 & it seems suspicious. Has anybody else come across this number?

== Message content ==

We have attempted to deliver ur package UPS016..., but there is an unpaid customs charge. Follow the instructions here: https://SNIP

== end ==

I didn't order anything from Australia and I don't have any parcels currently being shipped via UPS.

As carefully as I could I followed the link which led to https://SNIP which is a nginx server with a 403 Forbidden error.

Thanks for your input

Edit: Removed "possible" from the title.

Please keep this GZ community vibrant by contributing in a constructive & respectful manner.

This is a filtered page: currently showing replies marked as answers. Click here to see full discussion.

sidefx

3711 posts

Uber Geek

Trusted

#2616245 4-Dec-2020 10:37

Very common scam

https://www.nzherald.co.nz/nz/ups-courier-scam-thousands-of-kiwis-targeted-by-bogus-package-delivery-text/TTXBIGM7ECZJ4L6H24V5LSIQ54/

"I was born not knowing and have had only a little time to change that here and there." | Octopus Energy | Sharesies
- Richard Feynman

Oblivian

7296 posts

Uber Geek

ID Verified

#2616270 4-Dec-2020 11:08

I'm not sure where the data has been sourced, but they are doing regional it seems too.

Basically there was a mob of them sent to Kaiapoi users on Monday. Specifically mentioning the township too.

Also on the same day a 'Lotto is looking for Mr or Mrs x in <location> It's regarding the selection of your name. Click here <>'. Similar number CID +61 478 888 660

Obviously mass SMS provider and falsified GW/source

Decoded the short URL, and it was a new BS domain with survey, submitting the name in the message and the individual code. So potentially they are logging individual numbers of those who click the URL to confirm target too.

Short URL decode/sandbox

http://checkshorturl.com/

Most people click, back out, and then delete. But I believe if enough forwarded to DIA they can get the providers to start checking logs and intercept the delivery flow?