Insights into the clustering and reuse of phone numbers in scam emails

The article delves into the intricate world of scam campaigns and highlights the importance of phone numbers as key identifiers for tracking these operations. Here are the main points discussed:

Key Insights from the Article

1. Phone Numbers as Anchors:

   • Scammers often use specific VoIP providers to obtain large blocks of sequential phone numbers.
   • These numbers serve as persistent anchors in scam campaigns, unlike email addresses which can be easily changed.

2. Sequential Number Grouping:

   • Scammers purchase Direct Inward Dialing (DID) blocks and use sequential phone numbers within these blocks.
   • If one number is flagged or blocked by a carrier, scammers simply rotate to the next available number in the sequence.

3. Phone Block-Level Clustering:

   • Large-scale scam campaigns reuse phone numbers across multiple brand lures.
   • Example: A range of sequential numbers used for different brands like PayPal, Norton LifeLock, etc., showing how these blocks are deployed across various scams.

4. Reuse Across Different Lures and Formats:

   • The same phone number can appear in emails with different subject lines or body contents.
   • Phone numbers also appear in multiple attachment formats (e.g.,

Read the full article at Malware Analysis, News and Indicators - Latest topics

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.