In order to stay in business, spammers like to cycle through assets quickly, like email addresses and phone numbers. Once we detect an email address or phone number being used for phishing, we block it, then they use another one. However, sometimes spammers like to hold on to some of their assets for a while…a long while.
This SMS phish was recently sent out:
What's interesting is that this phone number has been used in email phishing since 2007, which is quite a long time in Internet terms: http://www.419scam.org/emails/2007-06/22/01058205.12.htm
But if you keep going back, there are samples from 2006: http://www.419scam.org/emails/2006-07/14/619719.1.htm
…And even 2005!! http://www.419scam.org/emails/2005-10/17/351179.619.htm
To put it in perspective, this same phone number has been in use in the year when Google Maps launched (February 8, 2005), NewsCorp purchased MySpace (July 18, 2005), and a little site you may have heard of called "YouTube" launched (February 15, 2005).
What would make a spammer keep the same number for such a long time? We can only speculate - maybe it's been quite profitable for him and doesn't want to give it up, or maybe it's the combination on his luggage.
What can be taken from this? Spammers are sending the same content to SMS as they are to email. The techniques that we've developed for email spam filtering should also be applied to SMS as well. That way, those spammers still hanging on to their pre-YouTube era phone numbers might have to consider getting new luggage.