The Latest in IT Security

Here’s an annoying SMS spam sent from +447979520064:

Short on Cash? Need a payday loan? 100% Apps Processed. Up to £750 today. Apply now at www.loanslineuk.co.uk to Opt Out Rply stop

We can easily identify the owner of loanslineuk.co.uk from their WHOIS records:

Domain name:
        loanslineuk.co.uk

    Registrant:
        gary mcneish

    Registrant type:
        Unknown

    Registrant’s address:
        flat 3 11a whitworth street
        opal house
        manchester
        M1 3GW
        United Kingdom
loanslineuk.co.uk simply forwards to moneyfix.co.uk via an affiliate link: www.moneyfix.co.uk/Default.aspx?AID=TETRUS&SAID=MONEYFIX_JPD_PARTNER1

The word “TETRUS” in the link is a clue. We can also see Gary McNeish’s address on the domain for tetr.us.. well, we could before it was re-registered to an address in the Seychelles:

Registrant ID:                               CR17598876
Registrant Name:                             gary mcneish
Registrant Address1:                         flat 3 11a whitworth street
Registrant Address2:                         opal house
Registrant City:                             manchester
Registrant State/Province:                   lancashire
Registrant Postal Code:                      m1 3gw
Registrant Country:                          United Kingdom
Registrant Country Code:                     UK
Registrant Phone Number:                     +7.799764944
Registrant Email:                            [email protected]
Registrant Application Purpose:              P1
If we look at the domain registration for tetrustelecoms.com we see the bogus address:

    tetrus, tetrus  [email protected]
    tetrus
    capital city, lancashire M35 0AE
    SC
    +66.838273350
There can’t be many people called Gary McNeish in Manchester, but oddly enough it isn’t the same Gary McNeish who was fingered for a fake Data Protection scam in 2002, but this Gary McNeish (Gary John Peter McNeish) was mentioned by the Daily Telegraph recently in an article called “For sale: your mobile phone number” which questioned the way that Mr McNeish obtained telephone numbers for leads.

According to Companies House, Tetrus Ltd was dissolved on 22/3/11, so it should no longer be trading.

If you get one of these, you should forward the spam to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 (“SPAM”). Vodafone customers should use 87726 (“VSPAM”) and Three customers should use 37726 (“3SPAM”). Hopefully the carriers will act if there are enough complaints.