Last Updated: 2026-10-03T23:21:32Z
What’s Happening
Over the last week or two I’ve been getting some interesting text messages claiming that I’ve either overpaid for car insurance or I’m owed money for a clinical trial. The domains change almost every day and so does the source phone number.
Searching in DNS shows they all have the same IP.
au[.]autosmartbudgets[.]com. 1800 IN A 104.168.133[.]136
tr[.]truthfullyinsured[.]com. 1800 IN A 104.168.133[.]136
re[.]recarejoin[.]com. 1800 IN A 104.168.133[.]136
pd[.]premiumdroplets[.]com. 1800 IN A 104.168.133[.]136
cl[.]clinicallylinked[.]com. 1800 IN A 104.168.133[.]136
sa[.]saferouteready[.]com. 1800 IN A 104.168.133[.]136
nslookup of the IP
136.133.168.104.in-addr.arpa name = hwsrv-1331121.hostwindsdns.com.
A lookup in ipinfo.io showed the IP is hosted with HostPapa on AS54290.
Registration Dates
au[.]autosmartbudgets[.]com 2026-05-21T21:11:21Z
tr[.]truthfullyinsured[.]com 2026-05-25T17:09:17Z
re[.]recarejoin[.]com 2026-06-05T20:14:13Z
pd[.]premiumdroplets[.]com 2026-06-04T18:40:58Z
cl[.]clinicallylinked[.]com 2026-08-18T20:09:50Z
sa[.]saferouteready[.]com 2026-06-15T21:40:45Z
I’ve had my phone number for a few years, but it was previously owned by a man in his 90s, and I frequently receive phising attempts targeting that demographic.
Going to one of the actual phishing links in the SMS will send you to the cloudflare IP 185.158.133[.]1 vs when you use the domain without the full URL you get 104.168.133[.]136.
Actions
Consider adding the domains and IP to blocklists.
Instruct others not to trust links seen in SMS.
Notes
IOCs
au[.]autosmartbudgets[.]com
tr[.]truthfullyinsured[.]com
re[.]recarejoin[.]com
pd[.]premiumdroplets[.]com
cl[.]clinicallylinked[.]com
sa[.]saferouteready[.]com
104.168.133[.]136
RDAP Data for the domains
Domain:
Domain Name: AUTOSMARTBUDGETS[.]COM
Handle: 3102297808_DOMAIN_COM-VRSN
Status: client transfer prohibited
Conformance: rdap_level_0
Conformance: icann_rdap_technical_implementation_guide_1
Conformance: icann_rdap_response_profile_1
Notice:
Title: Terms of Service
Description: Service subject to Terms of Use.
Link: Registry Data Access Protocol Terms of Service | Verisign
Notice:
Title: Status Codes
Description: For more information on domain status codes, please visit EPP Status Codes | What Do They Mean, and Why Should I Know? - ICANN
Link: EPP Status Codes | What Do They Mean, and Why Should I Know? - ICANN
Notice:
Title: RDDS Inaccuracy Complaint Form
Description: URL of the ICANN RDDS Inaccuracy Complaint Form: Submitting a Complaint to ICANN Contractual Compliance - ICANN
Link: Submitting a Complaint to ICANN Contractual Compliance - ICANN
Link: https://rdap.verisign.com/com/v1/domain/autosmartbudgets.com
Link: https://rdap.namecheap.com/domain/AUTOSMARTBUDGETS.COM
Event:
Action: registration
Date: 2026-05-21T21:11:21Z
Event:
Action: expiration
Date: 2027-05-21T21:11:21Z
Event:
Action: last changed
Date: 2026-05-21T21:11:24Z
Event:
Action: last update of RDAP database
Date: 2026-10-03T23:04:45Z
Secure DNS:
Delegation Signed: false
Entity:
Handle: 1068
Public ID:
Type: IANA Registrar ID
Identifier: 1068
Link: http://www.namecheap.com
Role: registrar
vCard version: 4.0
vCard fn: NameCheap, Inc.
Entity:
Role: abuse
vCard version: 4.0
vCard tel: tel:+1.6613102107
vCard email: abuse@namecheap.com
Nameserver:
Nameserver: DNS1.REGISTRAR-SERVERS.COM
Nameserver:
Nameserver: DNS2.REGISTRAR-SERVERS.COM
Domain:
Domain Name: TRUTHFULLYINSURED[.]COM
Handle: 3103550987_DOMAIN_COM-VRSN
Status: client transfer prohibited
Conformance: rdap_level_0
Conformance: icann_rdap_technical_implementation_guide_1
Conformance: icann_rdap_response_profile_1
Notice:
Title: Terms of Service
Description: Service subject to Terms of Use.
Link: Registry Data Access Protocol Terms of Service | Verisign
Notice:
Title: Status Codes
Description: For more information on domain status codes, please visit EPP Status Codes | What Do They Mean, and Why Should I Know? - ICANN
Link: EPP Status Codes | What Do They Mean, and Why Should I Know? - ICANN
Notice:
Title: RDDS Inaccuracy Complaint Form
Description: URL of the ICANN RDDS Inaccuracy Complaint Form: Submitting a Complaint to ICANN Contractual Compliance - ICANN
Link: Submitting a Complaint to ICANN Contractual Compliance - ICANN
Link: https://rdap.verisign.com/com/v1/domain/truthfullyinsured.com
Link: https://rdap.namecheap.com/domain/TRUTHFULLYINSURED.COM
Event:
Action: registration
Date: 2026-05-25T17:09:17Z
Event:
Action: expiration
Date: 2027-05-25T17:09:17Z
Event:
Action: last changed
Date: 2026-05-25T17:09:22Z
Event:
Action: last update of RDAP database
Date: 2026-10-03T23:04:45Z
Secure DNS:
Delegation Signed: false
Entity:
Handle: 1068
Public ID:
Type: IANA Registrar ID
Identifier: 1068
Link: http://www.namecheap.com
Role: registrar
vCard version: 4.0
vCard fn: NameCheap, Inc.
Entity:
Role: abuse
vCard version: 4.0
vCard tel: tel:+1.6613102107
vCard email: abuse@namecheap.com
Nameserver:
Nameserver: DNS1.REGISTRAR-SERVERS.COM
Nameserver:
Nameserver: DNS2.REGISTRAR-SERVERS.COM
Domain:
Domain Name: RECAREJOIN[.]COM
Handle: 3107867321_DOMAIN_COM-VRSN
Status: client transfer prohibited
Conformance: rdap_level_0
Conformance: icann_rdap_technical_implementation_guide_1
Conformance: icann_rdap_response_profile_1
Notice:
Title: Terms of Service
Description: Service subject to Terms of Use.
Link: Registry Data Access Protocol Terms of Service | Verisign
Notice:
Title: Status Codes
Description: For more information on domain status codes, please visit EPP Status Codes | What Do They Mean, and Why Should I Know? - ICANN
Link: EPP Status Codes | What Do They Mean, and Why Should I Know? - ICANN
Notice:
Title: RDDS Inaccuracy Complaint Form
Description: URL of the ICANN RDDS Inaccuracy Complaint Form: Submitting a Complaint to ICANN Contractual Compliance - ICANN
Link: Submitting a Complaint to ICANN Contractual Compliance - ICANN
Link: https://rdap.verisign.com/com/v1/domain/recarejoin.com
Link: https://rdap.namecheap.com/domain/RECAREJOIN.COM
Event:
Action: registration
Date: 2026-06-05T20:14:13Z
Event:
Action: expiration
Date: 2027-06-05T20:14:13Z
Event:
Action: last changed
Date: 2026-06-05T20:14:18Z
Event:
Action: last update of RDAP database
Date: 2026-10-03T23:04:45Z
Secure DNS:
Delegation Signed: false
Entity:
Handle: 1068
Public ID:
Type: IANA Registrar ID
Identifier: 1068
Link: http://www.namecheap.com
Role: registrar
vCard version: 4.0
vCard fn: NameCheap, Inc.
Entity:
Role: abuse
vCard version: 4.0
vCard tel: tel:+1.6613102107
vCard email: abuse@namecheap.com
Nameserver:
Nameserver: DNS1.REGISTRAR-SERVERS.COM
Nameserver:
Nameserver: DNS2.REGISTRAR-SERVERS.COM
Domain:
Domain Name: PREMIUMDROPLETS[.]COM
Handle: 3107480547_DOMAIN_COM-VRSN
Status: client transfer prohibited
Conformance: rdap_level_0
Conformance: icann_rdap_technical_implementation_guide_1
Conformance: icann_rdap_response_profile_1
Notice:
Title: Terms of Service
Description: Service subject to Terms of Use.
Link: Registry Data Access Protocol Terms of Service | Verisign
Notice:
Title: Status Codes
Description: For more information on domain status codes, please visit EPP Status Codes | What Do They Mean, and Why Should I Know? - ICANN
Link: EPP Status Codes | What Do They Mean, and Why Should I Know? - ICANN
Notice:
Title: RDDS Inaccuracy Complaint Form
Description: URL of the ICANN RDDS Inaccuracy Complaint Form: Submitting a Complaint to ICANN Contractual Compliance - ICANN
Link: Submitting a Complaint to ICANN Contractual Compliance - ICANN
Link: https://rdap.verisign.com/com/v1/domain/premiumdroplets.com
Link: https://rdap.namecheap.com/domain/PREMIUMDROPLETS.COM
Event:
Action: registration
Date: 2026-06-04T18:40:58Z
Event:
Action: expiration
Date: 2027-06-04T18:40:58Z
Event:
Action: last changed
Date: 2026-06-04T18:41:03Z
Event:
Action: last update of RDAP database
Date: 2026-10-03T23:04:45Z
Secure DNS:
Delegation Signed: false
Entity:
Handle: 1068
Public ID:
Type: IANA Registrar ID
Identifier: 1068
Link: http://www.namecheap.com
Role: registrar
vCard version: 4.0
vCard fn: NameCheap, Inc.
Entity:
Role: abuse
vCard version: 4.0
vCard tel: tel:+1.6613102107
vCard email: abuse@namecheap.com
Nameserver:
Nameserver: DNS1.REGISTRAR-SERVERS.COM
Nameserver:
Nameserver: DNS2.REGISTRAR-SERVERS.COM
Domain:
Domain Name: CLINICALLYLINKED[.]COM
Handle: 3133706385_DOMAIN_COM-VRSN
Status: client transfer prohibited
Conformance: rdap_level_0
Conformance: icann_rdap_technical_implementation_guide_1
Conformance: icann_rdap_response_profile_1
Notice:
Title: Terms of Service
Description: Service subject to Terms of Use.
Link: Registry Data Access Protocol Terms of Service | Verisign
Notice:
Title: Status Codes
Description: For more information on domain status codes, please visit EPP Status Codes | What Do They Mean, and Why Should I Know? - ICANN
Link: EPP Status Codes | What Do They Mean, and Why Should I Know? - ICANN
Notice:
Title: RDDS Inaccuracy Complaint Form
Description: URL of the ICANN RDDS Inaccuracy Complaint Form: Submitting a Complaint to ICANN Contractual Compliance - ICANN
Link: Submitting a Complaint to ICANN Contractual Compliance - ICANN
Link: https://rdap.verisign.com/com/v1/domain/clinicallylinked.com
Link: https://rdap.namecheap.com/domain/CLINICALLYLINKED.COM
Event:
Action: registration
Date: 2026-08-18T20:09:50Z
Event:
Action: expiration
Date: 2027-08-18T20:09:50Z
Event:
Action: last changed
Date: 2026-08-18T20:09:55Z
Event:
Action: last update of RDAP database
Date: 2026-10-03T23:04:45Z
Secure DNS:
Delegation Signed: false
Entity:
Handle: 1068
Public ID:
Type: IANA Registrar ID
Identifier: 1068
Link: http://www.namecheap.com
Role: registrar
vCard version: 4.0
vCard fn: NameCheap, Inc.
Entity:
Role: abuse
vCard version: 4.0
vCard tel: tel:+1.6613102107
vCard email: abuse@namecheap.com
Nameserver:
Nameserver: DNS1.REGISTRAR-SERVERS.COM
Nameserver:
Nameserver: DNS2.REGISTRAR-SERVERS.COM
Domain:
Domain Name: SAFEROUTEREADY[.]COM
Handle: 3111455544_DOMAIN_COM-VRSN
Status: client transfer prohibited
Conformance: rdap_level_0
Conformance: icann_rdap_technical_implementation_guide_1
Conformance: icann_rdap_response_profile_1
Notice:
Title: Terms of Service
Description: Service subject to Terms of Use.
Link: Registry Data Access Protocol Terms of Service | Verisign
Notice:
Title: Status Codes
Description: For more information on domain status codes, please visit EPP Status Codes | What Do They Mean, and Why Should I Know? - ICANN
Link: EPP Status Codes | What Do They Mean, and Why Should I Know? - ICANN
Notice:
Title: RDDS Inaccuracy Complaint Form
Description: URL of the ICANN RDDS Inaccuracy Complaint Form: Submitting a Complaint to ICANN Contractual Compliance - ICANN
Link: Submitting a Complaint to ICANN Contractual Compliance - ICANN
Link: https://rdap.verisign.com/com/v1/domain/saferouteready.com
Link: https://rdap.namecheap.com/domain/SAFEROUTEREADY.COM
Event:
Action: registration
Date: 2026-06-15T21:40:45Z
Event:
Action: expiration
Date: 2027-06-15T21:40:45Z
Event:
Action: last changed
Date: 2026-06-15T21:40:48Z
Event:
Action: last update of RDAP database
Date: 2026-10-03T23:04:45Z
Secure DNS:
Delegation Signed: false
Entity:
Handle: 1068
Public ID:
Type: IANA Registrar ID
Identifier: 1068
Link: http://www.namecheap.com
Role: registrar
vCard version: 4.0
vCard fn: NameCheap, Inc.
Entity:
Role: abuse
vCard version: 4.0
vCard tel: tel:+1.6613102107
vCard email: abuse@namecheap.com
Nameserver:
Nameserver: DNS1.REGISTRAR-SERVERS.COM
Nameserver:
Nameserver: DNS2.REGISTRAR-SERVERS.COM
The actual Text Messages
REFUND NOTICE: 2026 Auto ins was overpaid by 3,704.99. Get your money back by tonight: hxxp[://]au[.]autosmartbudgets[.]com/wvSqoONWqI STOP to End
Overpyment Alert: You overpaid 2026 Auto lns by 3,893.96. Return must be accepted by tonight: hxxp[://]tr[.]truthfullyinsured[.]com/hUENJSRLud STOP to End
Last Reminder: Your 3,768.31 clinical/research trial payment is waiting. Get it before it expires: hxxp[://]re[.]recarejoin[.]com/kTr2qvUhwm Stop to End
BiIling AIert: You overpaid 2026 Auto lns by 3,834.74. Must accept return by tonight: hxxp[://]pd[.]premiumdroplets[.]com/VIS6sOgtIb STOP to End
FinaI Notice: Your 2,191.61 clnicaI traiI payment is ready. Claim it before midnight: hxxp[://]cl[.]clinicallylinked[.]com/XWGIWk4FpM Stop to End
Whoops: You overpaid your 2026 Auto lns premiums by 3,804.85. Get it returned here: hxxp[://]sa[.]saferouteready[.]com/Y9SU2HY21v STOP to Optout
Oops: You overpaid your 2026 Auto lns payments by 3,864.89. Get it returned here: hxxp[://]sa[.]saferouteready[.]com/d9Pwb7eOEF STOP to Optout
urlscan.io Searches of one of the domains
Going to the domain with the domain name will reach the IP 104.168.133[.]136. When using the full URL from the text message it goes to a cloudflare IP.
