[cmroanirgo]

Have a look at their timeline. Very impressive, 3 mins from first sign (2 mins from first report), the domain is blocked.

(Edited a bit for brevity & mobiles)

> 22:49 UTC Attacker sends out 100+ SMS messages...

> 22:50 UTC Employees begin reporting SMS messages...

> 22:52 UTC Verify that the attacker's domain is blocked in Cloudflare Gateway for corporate devices.

> 22:58 UTC Warning communication sent to all employees across chat and email.

etc

[ipython]

I received no less than four Amazon refund scam phone calls today. If only we could have this accelerated timeline for “run of the mill” phishing scams, they would be so uneconomical to run and the volume would decrease significantly… sigh.

As it is I reported the two that didn’t use spoofed numbers to the owner of the number (onvoy/inteliquent as usual). Response time from them is basically infinite, as abuse reports basically go into a black hole.