41°
Known as “smishing” (SMS phishing), the scam involves fraudulent texts impersonating toll and package delivery services to trick recipients into clicking malicious links or revealing sensitive data.
According to cybersecurity firm Palo Alto Networks’ Unit 42, cybercriminals have registered over 10,000 fraudulent domains as part of this operation, targeting at least 11 states and one Canadian province.
Key Findings
Massive Domain Registration: More than 10,000 fake domains have been created—most beginning with “com-”—a subtle tactic used to deceive victims at a glance.
Targeted Locations: The scam has been reported in New York, New Jersey, Connecticut, Pennsylvania, Virginia, Massachusetts, California, Florida, Illinois, Kansas, and Texas, as well as Ontario, Canada.
Deceptive Tactics: Fraudulent texts often claim the recipient has an unpaid bill and must make an immediate payment to avoid penalties. Some messages circumvent Apple iMessage’s link-blocking restrictions by prompting users to reply “Y” instead of clicking a link.
Common Hosting Providers: More than 70 percent of these domains use the same two name servers, with 93 percent of IP addresses tied to Cloudflare.
The FBI is urging the public to delete any suspicious text messages immediately and avoid engaging with unknown senders. Authorities stress that taking proactive steps can prevent identity theft and financial fraud.
The scam, labeled “com_smishing,” remains under investigation, and officials encourage anyone receiving suspicious texts to report them to the FBI or their mobile carrier.
Click here to follow Daily Voice Manahawkin-Stafford and receive free news updates.
