SMS Apple (malware) spam on Bell Mobility (Canada)

SMS spam on Bell seems to have suddenly jumped.  On Tuesday, both Gloria and I got spam saying we had won something from Apple.  Today, we both got similar spam.

Today’s message came “from” 240-393-8527.  It asked us to visit hxxp://www.apple.com.ca.llhf.net [1]

Neither F-Secure nor VirusTotal had anything to say about it, but it is safe to assume that the site is dangerous.  Avast now blocks it.

In trying to contact Bell about this, I noted that Bell’s Website “contact” page lists a “Chat with us” function that simply does nothing if agents are busy, and no means of contacing Bell via email.  “How to escalate a complaint” returns the same page, with the same lack of response from the agent button.  When I finally did reach an agent, “he” was pretty clueless about the whole situation.  I strongly suspected “he” was a rather simplistic program.

Having Given the agent the information above, his response was to ask “Samuel: I understand. Have you registered under apple newsletter list?”  He then asked for my name and phone number (which I had previously given him at the beginning of the session), and then told me “Samuel: I unfortunately cannot unsubscribe that spam for you from here as I see in your account.”  He offered to cut the SMS/texting function on my account.

That’s it.  That’s the only solution.  Bell doesn’t have any spam filtering on SMS, even when the spam is as obvious, egregious, and malicious as this one.  (Yes, they do have a spam filtering option, if you want to pay them an extra $5 per month.  Given the quality of support, I think I’ll give that a miss.)

[1] Note that this isn’t apple.com, the trailing “domains” override that.  This domain is listed to:

Domain Name ………………… llhf.net
Name Server ………………… ns5.myhostadmin.net
ns6.myhostadmin.net
Registrant Name …………….. jun wang
Registrant Organization ……… wang jun
Registrant Address ………….. shang hai shi xu hui qu
Registrant City …………….. shang hai
Registrant Province/State ……. SH
Registrant Postal Code ………. 200087
Registrant Country Code ……… cn
Registrant Phone Number ……… 02178861511
Registrant Fax ……………… 02178861511
Registrant Email ……………. yaobing349@hotmail.com

Share
  • http://twitter.com/trendless Jeremy

    I got some of Telus that day, too

  • Shotoz

     Telus is affected also since one week.

  • Nomader Am

    Virgin is also affected.

  • http://www.host-it.ie/services/email-filtering/ spam filtering

    this is really important now a days to have a idea aboutspam filtering as we really need it for our work’s betterment.thanks for the post.