Insights into the clustering and reuse of phone numbers in scam emails
Summary: Cisco Talos tracked 1,652 unique phone numbers across scam campaigns impersonating PayPal, Geek Squad, McAfee and Norton LifeLock between February 26 and March 31, 2026, finding that 57 numbers (about 3.4%) were reused across consecutive days and the median number lifespan was roughly 14 days. Six of the ten largest campaigns in that window relied on VoIP infrastructure, with Sinch identified as the most commonly abused VoIP provider and sequential Direct Inward Dialing blocks rotated to replace flagged numbers.
What's compelling: One number, +1 804-713-4598, appeared in 117 scam emails in a single day, and the same numbers recur across unrelated lures and brands - so blocking individual sender addresses leaves the actual call-center infrastructure untouched.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026