Malaysian government behind “Telebiz” spam

Chief Exposer | Feb 17, 2021

Below is a brief look into how adversarial governments are invading your inbox with fraudulent email spam.

Update July 2022: Now using brand names: Arbermos

Update May 2022: Now using brand names: Surogou, Strastip

Update April 2022: Now using brand names: JilTel, Pivot Over

Update Feb 2022: Now using brand names: Mobiletelecommunication

Update September 2021: Now using brand names: Telecomroad

Update August 2021: Now using brand names: Backbonecalls, Goldmedalphones, Unlimitedpayable, Leveragingtelecommunications, Highqualitytelco, Thosephones

Update July 2021: And now using brand names: Phonecodes

Update June 2021: Now using brand name: Gadgetion, mobilequota, Mobits, Mobision

Update May 2021: They are now using brand names: SwapScreen

Update April 2021: We have discovered the CEO’s email address: [email protected]

Update April 2021: They are also using brand names: Answeropius, FDN Call Outsourcing, GrowthNexus, PharosComputer

Update March 2021: They are now using brand names: SnelComm

Update Feb 19, 2021: In the few days after this article was written, spammers continued to badger the author from various Gmail addresses, often forgetting which “company” they had said they were from previously; now they were claiming to be from “3C Phone Connect” and “Dial Answer Connect”. A new American man “Eddie” also began leaving me voice messages, saying he was following up from my spam emails sent by “Mike Jones”. Finally, yet another spammer “Karen” started emailing me from a SalesForce account connected to a parked domain dialanswerconnect.com which, like telebizint.com, is hosted on GoDaddy, while containing the same exact SOA DNS record, proving an undeniable connection.

Hucksters can exclusively reveal that Telebiz International, usually using various “alias” brand names that are not real entities, is behind the ongoing email spam campaign (and apparently, scam) that has been targeting American companies since at least mid-2020.

The head of Telebiz, Behzad Bawa, is a Pakistani national, who apparently leads the team of spammers; they use a wide variety of fake names that usually sound “American” like “Bob Marlin” or “Mike Jones” that sound obviously fake to many receiving the emails. (In one example, an email was sent by a Gmail account [email protected] but the FROM name was overwritten with the alias “Mike Jones”.)

The emails, which are very carefully crafted to avoid mentioning any “real” names or companies, seem to always come from @gmail.com accounts; the senders “test” initial interest by sending generic sales inquiries that offer a variety of phone services including voicemail, and if legitimate interest is shown by a target, the company (at least in the author’s experience) will soon receive a phone call from an American woman named “Kelly” who is following up on the sales conversation; in this author’s experience, “Kelly” wasn’t aware that the emails I had received were from “ConnexaPhone” and instead told me she was calling me back from “Dial Answer Connect*” instead. Other victims of this scam, revealed by CyberWyoming, have been told the company contacting them is either “InnaCall”, “Amiasa Telecom”, or “ConnexaWay”. (In fact, the only way we made the connection to Telebiz is because an attentive business owner in Wyoming was able to get one of the spammers to admit the connection.)

“Hi, this is Kelly with Dial Answer Connect. I was calling in regards to the interest you had in business phones. I just need to verify a few things with you to get a quote sent your way. My call back number is 580-619-5999.”

While a massive percent of email spam (and scams) seem to be based out of India and Pakistan, the incredible thing about the massive Telebiz fraud campaign is that their company appears to be directly affiliated with and managed by Multinet Pakistan, a large ISP and fiber-optic company from Pakistan that is owned by Telekom Malaysia.

Telekom Malaysia, or TM, is state-owned and is therefore controlled entirely by the government of Malaysia.

According to Telebiz’s own homepage, their headquarters is now based in Malaysia, and so are many of their team members. This would mean that the government of Malaysia is fully aware of what Telebiz is doing on a daily basis, and that they either directed or allowed this massive spam/scam campaign that is targeting American business owners, apparently in an effort to grow market share re: business phone services.

…which brings us back to Mr. Bawa, whose LinkedIn profile simultaneously says he is the CEO of Telebiz, and the Director of Exponentia Global which “forms international alliances” between telecom executives, and also the former CCO of Multinet Pakistan as well. In fact, a search of Malaysian companies did not turn up an results for Telebiz International, or any other Telebiz named company at the address listed on their official website. More than anything, Telebiz appears to be some sort of side hustle that Telekom Malaysia is running to cozy up with various telecom officials around the world while perhaps striking less-than-official deals, while mass-spamming Americans (and perhaps beyond).

To make matters even more muddy and political, ChinaCache recently launched a strategic partnership with Multinet Pakistan, meaning there are in fact 3 different governments involved in these companies behavior.

* Note: originally we believed voicemails were saying “Dial Interconnect” but it was “Dial Answer Connect”