Messaging security for evolving threats

SMS Sex Scams

Share with your network!

Sex scams are a common form of online fraud. In email, they often take the form of relationship fraud, where a confidence trickster may assume a fake persona and spend months or years building up an online relationship with a victim before asking for a large sum of money for plane tickets or a family emergency. Sending SMS messages in bulk requires a larger investment than sending emails, so SMS sex scams are geared to achieve a faster return on investment. The most common are the fake adult dating site, the fake adult verification site, and the fake sex worker. The fake adult dating site has a pretty simple lure. [Warning, disabled links in this post may contain nudity or other adult content.]

uhgytfy1380575 HeyI am a single horny and sexy girl.i love sex. i'm looking for a sex partner.See my personal profile and contact me babe:< http://cdarling [dot] llc/xn/VGi8J > no CC need babe.Join just only my gmail babe.
Annabelle nearby Chicago added 12 photos http://duty19sad [dot] tel/18CAy/e8
Tahlia nearby Fort Madison added 10 photos http://hurt128much [dot] tel/17dIU/8b

The landing page ask you to sign up with an email address, and once the address is confirmed you receive instant messages on the site, purportedly to be from members who want to chat to you. However, to receive the messages you have to sign up for a paid service. The fake adult verification site lures are a little more sophisticated. A simple chatbot will engage with the victim. It sends provocative pictures and texts, offers to meet to have sex, but asks the victim to confirm his identity with a paid service first.

chatbot1

 

 

 

 

chatbot2

 

 

 

In spite of my best efforts to determine if the chatbot was vegetarian, I did not receive an answer.

chatbot3

 

 

 

This particular bot randomly inserts accented characters in an apparent attempt to evade SMS content filtering, and substitutes some words with synonyms. In the last message you can see where the spammer got their bot’s macro substitution syntax wrong and instead of enclosing a list of synonyms in curly brackets, they used mismatched brackets, so both versions got included in the message. The most persistent of the fake sex workers is “Brook”. The Brook scam has been operating since 2016 or before (see https://theonlinedatingscams.com/brook-loreno-a-scam-by-any-other-name/ ). Victims are first attracted by an ad on Craigslist, Plenty of Fish, or other sites that carry adult dating ads. When they attempt to contact Brook by SMS, they get a response such as

Well my name's Brook.. MissPerkins [dot] org is my site with info on my sessions i provide

The site shows a video of a young woman who identifies herself as “Brooklyn”, and offers escort services at unrealistically low prices.

Brook Perkins website

 

 

 

However, she requires a “deposit” of $40 to be paid to a webcam site before the first session. Her last name changes frequently, but her first name stays as Brook, as that is mentioned in the video. Brook has used a number of domain names. Recently we have seen:

Miss-Perkins [dot] info MsPerkins [dot] net MissPerkins [dot] org MsParrish [dot] biz BrookPerkins [dot] org MsParrish [dot] org

In spite of the different domain names, the content is actually hosted on tumblr.com, and is frequently removed due to Tumblr’s recent decision to purge adult material. However, Brook is soon back with alternative Tumblr accounts. The same technique is use by “Marce” at playdatemarce [dot] com and “Marcy” at escortsverify [dot] com/VIPtokn9210/ . Both are apparently “100% French Brazilian Bombshell”, and both have websites with sound files to play, but the 1.0 version Marce only requires a $25 deposit, while Marcy 2.0 costs $50. The 2.0 website is smart enough to look up the geolocation of the IP address of the person visiting and make it look as if Marcy provides services there.

Geolocation

 

 

 

The escort deposit scam is common enough that one genuine escort who also uses SMS messaging to promote her business says on her website FAQ:

Prepay

 

 

 

Sextortion is quite rare in SMS messaging but we do see some not very convincing attempts.

For the attention of Mr. We inform you that we have information in our possession that is very crucial.perverse video we were sent by a net surfer in which we see you masturbating and this is an offense to modesty in Article 1365-29 of the International Constitution of thatWe also received a complaint against you from SYKPE SERVER CANAL and FACEBOOKwho has presented us a video of you on their site The video presents you hairy masturbating, you know very well that this kind of gesture is prohibited and illegal by the Law.Then a possible arrest will be made in a short time and a publication will also be carried out on the net in order to stop you by everyone and also send to your familyOption1: Any indecent assault committed or attempted without violence, coercion or surprise is punishable by 10 years' imprisonment. 'Penal Code, Article 331 amended by L. 80-1041 of 23 Dec. 1995.Option2: According to article 842 of the Penal Code it is written that whoever seized exercising a sexual offense in the territory will be penalized with a fine of $ 75,000 decree issued by the Minister of Justice.Option3: A fee will be asked if you want to cooperate.

It appears that there are no native English speakers running sextortion scams. At least Brook and Marcy speak English. If you receive a sex scam message or any sort of SMS spam you can report it by forwarding to 7726 (that’s S-P-A-M if you have letters on your keypad) in the US and several other countries. Check with your mobile carrier for full details.