User:Arjayay/Kenyan phone scam
Problem
As per the Nigerian phone scam - Multiple IPs inserting same mobile telephone numbers in multiple Kenyan articles:-
Numbers scammed
- [https://en.wikipedia.org/w/index.php?sort=relevance&search=insource%3A%220704143990%22&title=Special:Search&profile=advanced&fulltext=1&advancedSearch-current=%7B%7D&ns0=1&ns4=1&ns100=1 0704143990]
- [https://en.wikipedia.org/w/index.php?cirrusUserTesting=control&sort=relevance&search=insource%3A%220704++143990%22&title=Special:Search&profile=advanced&fulltext=1&advancedSearch-current=%7B%7D&ns0=1&ns4=1&ns100=1 0704 143990]
- [https://en.wikipedia.org/w/index.php?sort=relevance&search=insource%3A%22254704143990%22&title=Special:Search&profile=advanced&fulltext=1&advancedSearch-current=%7B%7D&ns0=1&ns4=1&ns100=1 254704143990]
:Note - these are the same number, but one has an area code at the beginning
- [https://www.google.co.uk/search?q=254704143990&ie=&oe= a google search] shows they are scamming the same numbers on twitter, facebook and other sites
- [https://en.wikipedia.org/w/index.php?cirrusUserTesting=control&sort=relevance&search=insource%3A%220792194950%22&title=Special:Search&profile=advanced&fulltext=1&advancedSearch-current=%7B%7D&ns0=1&ns4=1&ns100=1 0792194950] - added 31 March 2020 together with the normal number in [https://en.wikipedia.org/w/index.php?title=Maathai_Supermarkets&curid=46627610&diff=948304358&oldid=948304284 this edit]
- [https://en.wikipedia.org/w/index.php?cirrusUserTesting=glent_m0&sort=relevance&search=insource%3A%220792+194950%22&title=Special:Search&profile=advanced&fulltext=1&advancedSearch-current=%7B%7D&ns0=1&ns4=1&ns100=1 0792 194950] 15 June - as 31 March above but with 1 space
- [https://en.wikipedia.org/w/index.php?cirrusUserTesting=glent_m0&sort=relevance&search=insource%3A%220792+194+950%22&title=Special:Search&profile=advanced&fulltext=1&advancedSearch-current=%7B%7D&ns0=1&ns4=1&ns100=1 0792 194 950] 15 June - as 31 March above but with 2 spaces
Blocked 26 July 2020 - [https://en.wikipedia.org/w/index.php?title=Wikipedia:Edit_filter/Requested&oldid=969583472#Kenyan_phone_scam]
New formats in order to avoid the block filter
- [https://en.wikipedia.org/w/index.php?sort=relevance&search=insource%3A%22%E2%81%B07%E2%81%B04+14%C2%B3+99%E2%81%B0%22&title=Special:Search&profile=advanced&fulltext=1&advancedSearch-current=%7B%7D&ns0=1&ns2=1&ns4=1&ns10=1&ns14=1&ns100=1&ns118=1 ⁰7⁰4 14³ 99⁰] 06 August - New format 1 in list below
- [https://en.wikipedia.org/w/index.php?sort=relevance&search=insource%3A%22%E2%81%B07%E2%81%B04+143+99%E2%81%B0%22&title=Special:Search&profile=advanced&fulltext=1&advancedSearch-current=%7B%7D&ns0=1&ns2=1&ns4=1&ns10=1&ns14=1&ns100=1&ns118=1 ⁰7⁰4 143 99⁰] - New format 2 in list below
- [https://en.wikipedia.org/w/index.php?sort=relevance&search=insource%3A%22O7O4+1%E2%81%B43+99O%22&title=Special:Search&profile=advanced&fulltext=1&advancedSearch-current=%7B%7D&ns0=1&ns2=1&ns4=1&ns10=1&ns14=1&ns100=1&ns118=1 O7O4 1⁴3 99O] 07 August - New format 3 in list below
- [https://en.wikipedia.org/w/index.php?sort=relevance&search=insource%3A%22%E2%81%B07%E2%81%B04+1%E2%81%B43+99%E2%81%B0%22&title=Special:Search&profile=advanced&fulltext=1&advancedSearch-current=%7B%7D&ns0=1&ns2=1&ns4=1&ns10=1&ns14=1&ns100=1&ns118=1 ⁰7⁰4 1⁴3 99⁰] 07 August - New format 4 in list below
- [https://en.wikipedia.org/w/index.php?sort=relevance&search=insource%3A%22O7O%E2%81%B4+%C2%B9%E2%81%B4%C2%B3+99O%22&title=Special:Search&profile=advanced&fulltext=1&advancedSearch-current=%7B%7D&ns0=1&ns2=1&ns4=1&ns10=1&ns14=1&ns100=1&ns118=1 O7O⁴ ¹⁴³ 99O]10 August - New format 5 in list below
- [https://en.wikipedia.org/w/index.php?sort=relevance&search=insource%3A%22O7O4+%C2%B9%E2%81%B4%C2%B3+99O%22&title=Special:Search&profile=advanced&fulltext=1&advancedSearch-current=%7B%7D&ns0=1&ns2=1&ns4=1&ns10=1&ns14=1&ns100=1&ns118=1 O7O4 ¹⁴³ 99O] 10 August - New format 6 in list below
- [https://en.wikipedia.org/w/index.php?sort=relevance&search=insource%3A%22O79%C2%B2+%C2%B9%E2%81%B9%E2%81%B4+95O%22&title=Special:Search&profile=advanced&fulltext=1&advancedSearch-current=%7B%7D&ns0=1&ns2=1&ns4=1&ns10=1&ns14=1&ns100=1&ns118=1 O79² ¹⁹⁴ 95O] 21 September - new number - Format 7
- [https://en.wikipedia.org/w/index.php?sort=last_edit_desc&search=insource%3A%22O7O4+l43+99O%22&title=Special:Search&profile=advanced&fulltext=1&advancedSearch-current=%7B%7D&ns0=1&ns2=1&ns4=1&ns10=1&ns14=1&ns100=1&ns118=1&searchToken=9o9ovseyl675xar8yn0bjr43o O7O4 l43 99O] 02 November - New number format 8 - (lowercase L before the 43)
- O1O4 O27 587 - 13 Dec 2021
IPs
2020
- {{IP|41.57.103.191}} - Unknown - Kenya - Faiba - 2-4 January
- {{IP|197.183.16.97}} - Nairobi - Nairobi Province - Safaricom - 28 January
- {{IP|197.232.36.98}} - Nairobi - Nairobi Province - Faiba - 29 January
- {{IP|105.59.123.191}} - Nairobi - Nairobi Province - Safaricom - 31 January
- {{IP|196.102.87.116}} - Nairobi - Nairobi Province - Safaricom - 5 February
- {{IP|196.102.124.123}} - Nairobi - Nairobi Province - Safaricom - 5 February
- {{IP|41.60.234.145}} - Nairobi - Nairobi Province Real Time Technologies Alliance - Africa Organization: Liquid Telecommunications Ltd - 6 February
- {{IP|41.81.23.79}} - Nairobi - Nairobi Province - Safaricom - 13 February
- {{IP|196.105.199.138}} - Kisumu - Kisumu - Safaricom - 17 February
- {{IP|196.100.13.56}} - Nyahururu - Laikipia - Safaricom - 22 March
- {{IP|105.160.126.245}} - Nairobi - Nairobi Province - Safaricom - 22 March
- {{IP|196.101.244.11}} - Nairobi - Nairobi Province - Safaricom - 22 March
- {{IP|105.160.6.198}} - Kisumu - Kisumu - Safaricom - 22 March
- {{IP|41.81.239.205}} - Narok - Narok District - Safaricom - 23 March
- {{IP|41.81.119.182}} - Nairobi - Nairobi Province - Safaricom - 24 March
- {{IP|41.81.111.14}} - Nairobi - Nairobi Province - Safaricom - 25 March
- {{IP|41.81.226.32}} - Nairobi - Nairobi Province - Safaricom - 26 March
- {{IP|196.106.33.112}} - Nairobi - Nairobi Province - Safaricom - 26 March
- {{IP|105.160.126.235}} - Nairobi - Nairobi Province - Safaricom - 27 March
- {{IP|41.81.63.237}} - Nairobi - Nairobi Province - Safaricom - 27 March
- {{IP|41.81.131.254}} - Nairobi - Nairobi Province - Safaricom - 27 March
- {{IP|105.160.33.93}} - Nairobi - Nairobi Province - Safaricom - 27 March
- {{IP|196.107.113.147}} - Nairobi - Nairobi Province - Safaricom - 10 April
- {{IP|41.81.196.248}} - Nairobi - Nairobi Province - Safaricom - 10 April
New numbers
- {{IP|41.215.92.63}} - Kenya - ACCESSKENYA GROUP LTD is an ISP serving - 15 June
- {{IP|41.81.84.18}} - Nairobi - Nairobi Province - Safaricom - 24 July
2021
- {{IP|105.160.1.97}} - Nairobi - Nairobi Province - Safaricom - 13 December
=Accounts=
- {{User|Elisha Ogello}} 11 November 2019 - 7 February 2020
- {{User|Jamach Smolbatoks}} - 15 February
- {{User|Penny Aswiroh}} - 31 March
- {{User|Bebi Grace}} - 31 March + 5 April
- {{User|Gaviria Escobar}} - 31 March
- {{User|Siaya Kababa}} - 31 March
- {{User|Pablaw Escobar}} - 31 March
- {{User|Elisha Cartelloh}} - 31 March
- {{User|Gigamart Limited}} - 01 April
- {{User|Elisa Mogul}} - 02 April
- {{User|Peniel lbrahims}} - 02 April
- {{User|Dunkan Stevoh}} - 02 April
- {{User|Ralah Odingah}} - 02 April
- {{User|FckuArjay}} - 04 April - Always nice to know I'm doing something right
- {{User|FAy Favors}} - 25 April
- {{User|Olundih Theriz}} - 5 May
- {{User|Ebeneza Pacho}} - 21 July
- {{User|Agweng Tahero}} - 21 July
- {{User|Wuod onags}} - 21 July
- {{User|Pacha Baba}} - 21 July
- {{User|Manguraitha}} - 22 July
- {{User|Thergueno}} - 22 July
- {{User|Aurajapuonj}} - 22 July
- {{User|Amaranthasvaginosa}} - 23 July
- {{User|Hotelcartelos}} - 23 July
- {{User|Kenpingnairos}} - 23 July
- {{User|Arabuoil}} - 23 July
- {{User|Aeleh}} - 24 July
- {{User|Aeloh}} - 25 July
- {{User|Aelih}} - 25 July
- {{User|Abalah}} - 26 July
- {{User|Abalehhi}} - 26 July
Hiatus as original numbers blocked
= New format numbers =
- {{User|Bykaysega}} - 06 August - New format 1
- {{User|Jarabuoni}} - 06 August - New format 1
- {{User| Benaowiyeh}} - 07 August - New format 2
- {{User|Abenidah}} - 07 August - New format 3
- {{User|Apisimarah}} - 07 August - New format 4
- {{User|Jajomokenyas}} - 10 August - New format 5
- {{User|Naivoshah}} - 10 August - New format 6
- {{User|Wuodjomoh}} - 11 August - New format 6
- {{User|Mkudean}} - 11 August - New format 6
- {{User|Egertondean}} - 11 August - New format 6
- {{User|Naivasio}} - 12 August - New format 6
- {{User|MKUUNIVERS}} - 12 August - New format 6
- {{User|Chandasio}} - 13 August - New format 6
- {{User|Uchumisi}} - 13 August - New format 6
- {{User|Nairohsah}} - 13 August - New format 6
- {{User|Alikarea}} - 21 September - New format 7
- {{User|Alikarema}} - 21 September - New format 7
- {{User|Jasejera}} - 21 September - New format 7
- {{User|Oyawah}} - 07 October - New format 6
- {{User|Oyaweh}} - 07 October - New format 6
- {{User|Oyawuhh}} - 07 October - New format 6
- {{User|Kwsken.}} - 02 November - New format 8
- {{User|Naironcnty}} - 02 November - New format 8
- {{User|Kisiiken}} - 02 November - New format 8
- {{User|Kdfken}} - 02 November - New format 8
- {{User|Kisiaken}} - 04 November - New format 8
- {{User|Kukenia}} - 04 November - New format 8
- {{User|Strathasmosba}} - 04 November - New format 8
- {{User|Chandonatgri}} - 15 November - New format 8
- {{User|Jkchietha}} - 29 December - New format 6
- {{User|Tukgck}} - 29 December - New format 6
- {{User|Egertonahctha}} - 30 December - New format 6
- {{User|Wiyefuongochiethag}} - 30 December - New format 6
- {{User|Uonhachieth}} - 30 December - New format 6
- {{User|Tukenyachetha}} - 30 December - New format 6
- {{User|Alichiethagh}} - 31 December - New format 6
- {{User|Donermothfckyooh}} - 31 December - New format 6
- {{User|Techniblessinggd}} - 31 December - New format 6
- {{User|Mkublessinggd}} - 31 December - New format 6
==2021==
- {{User|Manguraisah}} - 01 January - New format 6
- {{User|Mkuaraingois}} - 01 January - New format 6
- {{User|Msenoscholio}} - 01 January - New format 6
- {{User|Ngaduriosaes}} - 01 January - New format 6
- {{User|Msnchieth}} - 04 January - New format 6
- {{User|Allionceratihs}} - 04 January - New format 6
- {{User|Techchiethahie}} - 04 January - New format 6
- {{User|Awuorowadahe}} - 04 January - New format 6
- {{User|Jkartahie}} - 05 January - New format 6
- {{User|Mkuagadf}} - 05 January - New format 6
- {{User|Tukeniarta}} - 05 January - New format 6
- {{User|Pablohunterss}} - 16 June - New format 6
- {{User|Pablousiseraousem}} - 16 June - New format 6
- {{User|Alegokendgih}} - 28 June - New format 6
- {{User|Elchapopablos}} - 28 June - New format 6
- {{User|Raodingachiethah}} - 28 June - New format 6
- {{User|Jalegojaurah}} - 28 June - New format 6
- {{User|Raodingaizeh}} - 28 June - New format 6
- {{User|Raodingoise}} - 28 June - New format 6
- {{User|Pablosaurouses}} - 28 June - New format 6
- {{User|Wuodachietha}} - 05 July - New format 6
AIV template
Articles attacked
- Chandarana Food Plus Supermarkets
- Eastmatt Supermarkets
- Carrefour
- Choppies
- Maathai Supermarkets
- Naivas Limited
- Tuskys
- Uchumi Supermarkets
- Karen Hospital
- Kenyatta National Hospital
- Nairobi County
- Agoro Sare High School
- Alliance Girls High School
- Alliance High School (Kenya)
- Bishop Gatimu Ngandu Girls High School
- Brookhouse School
- Egerton University
- Friends School Kamusinga
- Hillcrest School (Nairobi, Kenya)
- Jomo Kenyatta University of Agriculture and Technology
- Kagumo High School
- Kangaru High School
- Kapsabet High School
- Kenya Defence Forces
- Kenya High School
- Kenya Wildlife Service
- Kenyatta University
- Kianda School
- Kisii School
- Kisii University
- Lenana School
- Loreto High School, Limuru
- Lwak Girls' High School
- Mang'u High School
- Maranda High School
- Maseno School
- Maseno University
- Moi High School – Kabarak
- Moi University
- Mombasa County
- Mount Kenya University
- Murang'a High School
- Nairobi School
- Nakuru Boys High School
- Ng'iya Girls High School
- Nyambaria High School
- Nyeri High School
- Starehe Boys' Centre and School
- Starehe Girls' Centre
- Strathmore School
- Strathmore University
- Technical University of Kenya
- Technical University of Mombasa
- Trushar Khetia
- United States International University Africa
- University of Eldoret
- University of Nairobi
- Harvard Business School
2023 revival
- I first detected this 4 Jan 2023, but may be much earlier
- May or may not be directly related, but similar addition of false phone numbers
- Numbers are being added in squares - "Emoji blocks" ?
- 0️⃣7️⃣0️⃣6️⃣8️⃣1️⃣3️⃣6️⃣1️⃣9️⃣ 4 + 5 Jan 0706813619
- 0️⃣7️⃣6️⃣8️⃣7️⃣4️⃣8️⃣9️⃣6️⃣8️⃣ 6 Jan 0768748968
= IPs =
- {{IP|105.164.36.36}} - Nairobi - Nairobi City - Safaricom Limited - 4 January
- {{IP|197.237.138.206}} - Nairobi - Nairobi City - Wananchi Group - 5 + 6 January blocked to 7 Jan
- {{IP|41.81.212.116}} - Ruiru - Kiambu - Safaricom Limited - 5 January
= Articles attacked =
2023 revival #2
- I first detected this 19 Jan 2023, but may be earlier
- 0202000587
- 0771162517
- O77II625I7 - trying to evade detection using letters as in previous scams
- O2O2OOO587 - trying to evade detection using letters as in previous scams
= Users/IPs =
- {{User|Mwalimu2023}} - 19 Jan
- {{User|Mwalimu2024}} - 20 Jan
- {{User|Mwalimu2025}} - 20 Jan