Sponsored by..

Tuesday 4 October 2011

SMS Spam: loanslineuk.co.uk / Gary McNeish

Here's an annoying SMS spam sent from +447979520064:
Short on Cash? Need a payday loan? 100% Apps Processed. Up to £750 today. Apply now at www.loanslineuk.co.uk to Opt Out Rply stop
We can easily identify the owner of loanslineuk.co.uk from their WHOIS records:

Domain name:

        gary mcneish

    Registrant type:

    Registrant's address:
        flat 3 11a whitworth street
        opal house
        M1 3GW
        United Kingdom

loanslineuk.co.uk simply forwards to moneyfix.co.uk via an affiliate link: www.moneyfix.co.uk/Default.aspx?AID=TETRUS&SAID=MONEYFIX_JPD_PARTNER1

The word "TETRUS" in the link is a clue. We can also see Gary McNeish's address on the domain for tetr.us.. well, we could before it was re-registered to an address in the Seychelles:

Registrant ID:                               CR17598876
Registrant Name:                             gary mcneish
Registrant Address1:                         flat 3 11a whitworth street
Registrant Address2:                         opal house
Registrant City:                             manchester
Registrant State/Province:                   lancashire
Registrant Postal Code:                      m1 3gw
Registrant Country:                          United Kingdom
Registrant Country Code:                     UK
Registrant Phone Number:                     +7.799764944
Registrant Email:                            gary@tetrustelecoms.com
Registrant Application Purpose:              P1

If we look at the domain registration for tetrustelecoms.com we see the bogus address:

    tetrus, tetrus  serialsniper@gmail.com
    capital city, lancashire M35 0AE

There can't be many people called Gary McNeish in Manchester, but oddly enough it isn't the same Gary McNeish who was fingered for a fake Data Protection scam in 2002, but this Gary McNeish (Gary John Peter McNeish) was mentioned by the Daily Telegraph recently in an article called "For sale: your mobile phone number" which questioned the way that Mr McNeish obtained telephone numbers for leads.

According to Companies House, Tetrus Ltd was dissolved on 22/3/11, so it should no longer be trading.

If you get one of these, you should forward the spam to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

Added: The Slough Times has some more background information here.


stoatwblr said...

McNeish has popped up at ukservers.com with "www.baye.biz"

Ukservers don't want to know about it.

stoatwblr said...

Another uk hoster:


Hosted at webfusion (http://www.webfusion.co.uk/)

stoatwblr said...

the ICO has hit McNeish with a large fine for being an unregistered data controller.

Apparently further investigations are proceeding.