Many of the large SMS spam attacks we see at AdaptiveMobile attempt to cover as much ground as they can before being shut down. For example the US bank smsishing attacks we looked at in previous blog entries targeted 200+ different area codes. However there are some notable exceptions, and high volume attacks on individual locations are becoming increasingly common. In GSIM 8 we analyse the behaviuor of JunkCar messages and the ruthless sending pattern that distributes thousands of messages within the Miami area to 305 and 786 numbers.
In a similar fashion, the map below shows a Canadian adult dating spam attack that we have been tracking over a five day period from the 17th - 21st of August. What's interesting about this is that it seems to be focused almost entirely on the Canadian province of Saskatchewan with 80,000 of the 90,000 messages being sent to locations within the province and the remaining 10,000 were destined for the city of Winnipeg in the neighbouring province, Manitoba.
We found that many of the messages were personalised but standard messages were also present (see examples below)
"Here's the crazy casuals site I told you about at work Jon, [REDACTED] - I got lots of action last week, easier than POF for getting women :p"
"Spencer here's that casuals website I told u I got loads of play on, [REDACTED] - Easier than bars, you'll do well on it. Still need a ride later?"
"Victor here's that casuals website I told u I got loads of play on, [REDACTED]- Easier than bars, you'll do well on it. Still need a ride later?"
The other obvious interesting fact about this spam is that it is not being sent to almost all of the other provinces, not even the nearby towns across the border in Alberta. In this case what seems to be happening is that the spammers have decided to focus on one area for a particular length of time with adult campaign type messages. Purely speculating, this may be due to Saskatchewan's oil-based booming economy and population influx, which is seeing some towns having double-digit population growth. However this does not mean spammers won’t change the target destination in the future. The fact that Winnipeg, Manitoba has received a low amount of spam could suggest that they are testing this area prior to moving. With this in mind it is wise to assume that this attack won't stay confined to Saskatchewan and could eventually target any part of Canada. As always stay vigilant when it comes to spam and talk to your operator about how they can keep your phone safe.