User:Arjayay/Kenyan phone scam

Problem
As per the Nigerian phone scam - Multiple IPs inserting same mobile telephone numbers in multiple Kenyan articles:-

Numbers scammed

 * 0704143990
 * 0704 143990


 * 254704143990
 * Note - these are the same number, but one has an area code at the beginning


 * a google search shows they are scamming the same numbers on twitter, facebook and other sites


 * 0792194950 - added 31 March 2020 together with the normal number in this edit


 * 0792 194950 15 June - as 31 March above but with 1 space


 * 0792 194 950 15 June - as 31 March above but with 2 spaces

Blocked 26 July 2020 -

New formats in order to avoid the block filter
 * ⁰7⁰4 14³ 99⁰ 06 August - New format 1 in list below
 * ⁰7⁰4 143 99⁰ - New format 2 in list below
 * O7O4 1⁴3 99O 07 August - New format 3 in list below
 * ⁰7⁰4 1⁴3 99⁰ 07 August - New format 4 in list below
 * O7O⁴ ¹⁴³ 99O10 August - New format 5 in list below
 * O7O4 ¹⁴³ 99O 10 August - New format 6 in list below


 * O79² ¹⁹⁴ 95O 21 September - new number - Format 7


 * O7O4 l43 99O 02 November - New number format 8 - (lowercase L before the 43)


 * O1O4 O27 587 - 13 Dec 2021

IPs
2020
 * - Unknown    - Kenya - Faiba -  2-4 January
 * - Nairobi    - Nairobi Province - Safaricom - 28 January
 * - Nairobi    - Nairobi Province - Faiba - 29 January
 * - Nairobi    - Nairobi Province - Safaricom - 31 January
 * - Nairobi    - Nairobi Province - Safaricom - 5 February
 * - Nairobi    - Nairobi Province - Safaricom - 5 February
 * - Nairobi    - Nairobi Province  Real Time Technologies Alliance - Africa Organization: Liquid Telecommunications Ltd  - 6 February
 * - Nairobi    - Nairobi Province - Safaricom - 13 February
 * - Kisumu     - Kisumu           - Safaricom - 17 February


 * - Nyahururu  - Laikipia         - Safaricom - 22 March
 * - Nairobi    - Nairobi Province - Safaricom - 22 March
 * - Nairobi    - Nairobi Province - Safaricom - 22 March
 * - Kisumu     - Kisumu           - Safaricom - 22 March
 * - Narok      - Narok District   - Safaricom - 23 March
 * - Nairobi    - Nairobi Province - Safaricom - 24 March
 * - Nairobi    - Nairobi Province - Safaricom - 25 March
 * - Nairobi    - Nairobi Province - Safaricom - 26 March
 * - Nairobi    - Nairobi Province - Safaricom - 26 March
 * - Nairobi    - Nairobi Province - Safaricom - 27 March
 * - Nairobi    - Nairobi Province - Safaricom - 27 March
 * - Nairobi    - Nairobi Province - Safaricom - 27 March
 * - Nairobi    - Nairobi Province - Safaricom - 27 March
 * - Nairobi    - Nairobi Province - Safaricom - 10 April
 * - Nairobi    - Nairobi Province - Safaricom - 10 April

New numbers
 * - Kenya      - ACCESSKENYA GROUP LTD is an ISP serving - 15 June
 * - Nairobi    - Nairobi Province - Safaricom - 24 July

2021
 * - Nairobi    - Nairobi Province - Safaricom - 13 December

Accounts
Hiatus as original numbers blocked
 * 11 November 2019 - 7 February 2020
 * - 15 February
 * - 31 March
 * - 31 March + 5 April
 * - 31 March
 * - 31 March
 * - 31 March
 * - 31 March
 * - 01 April
 * - 02 April
 * - 02 April
 * - 02 April
 * - 02 April
 * - 04 April - Always nice to know I'm doing something right
 * - 25 April
 * - 5 May
 * - 21 July
 * - 21 July
 * - 21 July
 * - 21 July
 * - 22 July
 * - 22 July
 * - 22 July
 * - 23 July
 * - 23 July
 * - 23 July
 * - 23 July
 * - 24 July
 * - 25 July
 * - 25 July
 * - 26 July
 * - 26 July

New format numbers

 * - 06 August - New format 1
 * - 06 August - New format 1
 * - 07 August - New format 2
 * - 07 August - New format 3
 * - 07 August - New format 4
 * - 10 August - New format 5
 * - 10 August - New format 6
 * - 11 August - New format 6
 * - 11 August - New format 6
 * - 11 August - New format 6
 * - 12 August - New format 6
 * - 12 August - New format 6
 * - 13 August - New format 6
 * - 13 August - New format 6
 * - 13 August - New format 6


 * - 21 September - New format 7
 * - 21 September - New format 7
 * - 21 September - New format 7


 * - 07 October - New format 6
 * - 07 October - New format 6
 * - 07 October - New format 6


 * - 02 November - New format 8
 * - 02 November - New format 8
 * - 02 November - New format 8
 * - 02 November - New format 8


 * - 04 November - New format 8
 * - 04 November - New format 8
 * - 04 November - New format 8


 * - 15 November - New format 8


 * - 29 December - New format 6
 * - 29 December - New format 6


 * - 30 December - New format 6
 * - 30 December - New format 6
 * - 30 December - New format 6
 * - 30 December - New format 6


 * - 31 December - New format 6
 * - 31 December - New format 6
 * - 31 December - New format 6
 * - 31 December - New format 6

2021

 * - 01 January - New format 6
 * - 01 January - New format 6
 * - 01 January - New format 6
 * - 01 January - New format 6


 * - 04 January - New format 6
 * - 04 January - New format 6
 * - 04 January - New format 6
 * - 04 January - New format 6


 * - 05 January - New format 6
 * - 05 January - New format 6
 * - 05 January - New format 6


 * - 16 June - New format 6
 * - 16 June - New format 6


 * - 28 June - New format 6
 * - 28 June - New format 6
 * - 28 June - New format 6
 * - 28 June - New format 6
 * - 28 June - New format 6
 * - 28 June - New format 6
 * - 28 June - New format 6


 * - 05 July - New format 6

AIV template * Kenyan phone scammer - as explained here - ~

Articles attacked

 * Chandarana Food Plus Supermarkets
 * Eastmatt Supermarkets
 * Carrefour
 * Choppies
 * Maathai Supermarkets
 * Naivas Limited
 * Tuskys
 * Uchumi Supermarkets
 * 
 * 
 * Karen Hospital
 * Kenyatta National Hospital
 * Nairobi County
 * 
 * 
 * Agoro Sare High School
 * Alliance Girls High School
 * Alliance High School (Kenya)
 * Bishop Gatimu Ngandu Girls High School
 * Brookhouse School
 * Egerton University
 * Friends School Kamusinga
 * Hillcrest School (Nairobi, Kenya)
 * Jomo Kenyatta University of Agriculture and Technology
 * Kagumo High School
 * Kangaru High School
 * Kapsabet High School
 * Kenya Defence Forces
 * Kenya High School
 * Kenya Wildlife Service
 * Kenyatta University
 * Kianda School
 * Kisii School
 * Kisii University
 * Lenana School
 * Loreto High School, Limuru
 * Lwak Girls' High School
 * Mang'u High School
 * Maranda High School
 * Maseno School
 * Maseno University
 * Moi High School – Kabarak
 * Moi University
 * Mombasa County
 * Mount Kenya University
 * Murang'a High School
 * Nairobi School
 * Nakuru Boys High School
 * Ng'iya Girls High School
 * Nyambaria High School
 * Nyeri High School ‎
 * Starehe Boys' Centre and School
 * Starehe Girls' Centre‎
 * Strathmore School
 * Strathmore University
 * Technical University of Kenya
 * Technical University of Mombasa
 * Trushar Khetia
 * United States International University Africa
 * University of Eldoret
 * University of Nairobi
 * 
 * Harvard Business School

2023 revival

 * I first detected this 4 Jan 2023, but may be much earlier
 * May or may not be directly related, but similar addition of false phone numbers
 * Numbers are being added in squares - "Emoji blocks" ?
 * 0️⃣7️⃣0️⃣6️⃣8️⃣1️⃣3️⃣6️⃣1️⃣9️⃣ 4 + 5 Jan 0706813619
 * 0️⃣7️⃣6️⃣8️⃣7️⃣4️⃣8️⃣9️⃣6️⃣8️⃣ 6 Jan 0768748968

IPs

 * - Nairobi - Nairobi City - Safaricom Limited - 4 January
 * - Nairobi - Nairobi City - Wananchi Group - 5 + 6 January blocked to 7 Jan
 * - Ruiru - Kiambu - Safaricom Limited - 5 January

Articles attacked

 * Bamburi Cement
 * Bishop Gatimu Ngandu Girls High School
 * KCB Bank Kenya Limited
 * Kapsabet High School
 * Kenya High School‎

2023 revival #2

 * I first detected this 19 Jan 2023, but may be earlier
 * 0202000587
 * 0771162517
 * O77II625I7 - trying to evade detection using letters as in previous scams
 * O2O2OOO587 - trying to evade detection using letters as in previous scams

Users/IPs

 * - 19 Jan
 * - 20 Jan
 * - 20 Jan

Articles attacked

 * Alliance High School (Kenya)
 * Butere Girls High School
 * Kakamega School
 * Kenya High School
 * Kianda School
 * Lenana School
 * Loreto High School, Limuru
 * Lwak Girls' High School
 * Mang'u High School
 * Maranda High School
 * Maseno School
 * Nyeri High School