Operational assessment · Telegram export through 27 September 2026
BlackTail Sip
Assessment of a SIP retail channel used for institution impersonation.
The channel @BlackTailSip, 339 subscribers at the time of export, sells one-channel SIP access. Payment is in cryptocurrency and no identity check is required. The advertised capability is presentation of genuine US bank, credit-union, and Google calling numbers, and completion of calls to those institutions’ published numbers. The attached user file contains 12,900 rows and 100 distinct accounts.
1. Assessment
Service description
BlackTail Sip retails a live-agent SIP seat for US institution impersonation. UK routes are also advertised. The buyer receives a SIP login for a standard softphone and can place one call at a time. The commercial claim has two parts: the called party sees a genuine institution number, and calls placed to the institution’s own toll-free numbers complete.
The channel was created on 25 August 2026. The first sales post is dated 4 September. By 17 September the application database held 100 logins, and the billing platform had issued SIP user id 1,031. Seventeen SIP ids in this file predate the Telegram channel. The channel is a new storefront on an existing billing system.
Counts below use the 100 distinct accounts. The file’s 12,900 rows are 129 exact copies of those accounts. Wallet balances are prepaid credit remaining at 18 September 2026, 12:08 UTC. They are neither revenue nor call volume.
2. Architecture
Storefront, application, and billing platform
339 subscribers
day pass, free tests
one call at a time
Every account record includes magnusUserId and magnusUsername. The SIP username matches the application username. MagnusBilling is an open-source Asterisk billing platform used for prepaid SIP. The application in front of it is separate: UUID primary keys, a wallet table, bcrypt cost-12 password hashes, currency set to USD, and unused fields for an API key, a reseller parent, a device fingerprint, and a signup IP.
Signup IP and device fingerprint are null on all 100 accounts, so this file does not locate customers. Six accounts use the mail domain zydex.local. On 18 September the channel published the file with the caption “@zydex_p1 USER LIST”. Zydex is the panel name. BlackTail is the customer-facing brand.
Named contact points
@wosh04 is the only support identity named in the channel. Complimentary access is applied manually. The channel text is “msg me with your sip users.” The secondary contact, posted on 18 September, is WhatsApp +44 7347 734470.
This is a UK mobile. Ofcom’s numbering notification of 13 January 2025 allocates block 073477 to Vodafone Limited, allocation date 14 October 2024. That identifies the range holder. It does not identify the current serving network or the subscriber. No public page references this exact number. No line-status lookup was run.
Daily route-status messages
The channel repeatedly states that the bot is up and that routes are passing. A standing wholesale trunk is not normally announced this way. The pattern is consistent with upstream routes being withdrawn and replaced. On 20 September the day rate moved from $35 to $40 and was described as a change to premium routes.
3. Call flows
Two directions from the same seat
Calling number seen by the called party
The caller presents a real bank, credit-union, or Google number. Where the trunk delivers that number unchanged, the terminating mobile network returns CNAM, and the handset displays the institution name with the number. Observed names include JPMORGAN CHASE, BANK OF AMERICA, CITIBANK, PNC BANK, M&T BANK, and HUNTINGTON.
The channel’s own screenshots are incoming-call screens on one iPhone: the same wallpaper and morning timestamps. They document calling-number presentation. They are not screenshots of an outbound dialer. A later customer forward shows the same result on Android: display name Google, number 866-246-6453.
Completion to published numbers
In this market, a main number “passing” means a call to the institution’s published toll-free is answered, rather than blocked as spam or refused by the upstream. The 23 September post is that working list. It instructs users to switch to an alternate number when a main number fails, because the alternate still returns the institution name.
The alternates in the screenshots are departmental numbers. Chase’s example is military services, 877-469-0110, which Chase publishes. Bank of America’s example is home equity, 800-269-3084, which Bank of America publishes. Both return the parent name in CNAM. These are secondary published numbers, not the number printed on a typical card.
The two directions correspond to the standard use of this product: a call to the customer that presents as the institution, and a call to the institution that can present as the customer or be joined to the customer’s call. This export contains the sales claims and the caller-ID screenshots. It contains no recording and no call detail records. A joined call is inferred from the product type. It was not observed in this material.
CNAM and STIR/SHAKEN
US mobile networks perform a CNAM lookup on the calling number. The displayed name is the name stored against that number. When the channel says an alternate “shows the name too,” the CNAM record for that number still returns the institution. Screenshots with a name, and screenshots from the same handset with digits only, are the same test with different CNAM results. Citizens’ main number, 800-922-9999, is on the working list and in the album, and that screenshot has no name. That matches the instruction to use an alternate when the main number does not display a name.
STIR/SHAKEN is the US framework for authenticating that the caller is entitled to present a number. The screenshots show an institution name and digits on an iPhone. The export contains no SIP Identity header. It does not show whether an upstream signed the calls, or whether the terminating operator displayed a number that failed or lacked attestation. What is evidenced is that the presented number and, in several cases, the CNAM name reached the handset.
The one-concurrent-call limit prices the $40 product as a single live agent. Press-1 requires many channels and is offered as a separate product.
4. Terminology
Channel language and operational meaning
| What they say | What it refers to |
|---|---|
| Passing / 95% of main numbers pass | A call to the institution’s published number completes. |
| Main vs alts | The widely published toll-free, as distinct from a departmental or branch number that still returns the institution in CNAM. |
| Shows the name | The called party’s phone displays the institution name as well as the digits. Documented in the incoming-call screenshots. |
| USA bank routes, UK and USA premium routes | Two country products. US bank and credit-union numbers are the ones they actually listed. UK is advertised and shows up in customer names. |
| 1 concurrent call | A Magnus-style channel cap. One live conversation per seat. |
| 3 free calls, up to 1 minute | Sufficient to test CNAM display and whether an IVR answers. Shorter than a typical social-engineering call. |
| Bot is up / load up and start dialing | The current upstream is completing calls. Used as a daily availability notice. |
| Msg me with your SIP users | Credit is added by hand against the SIP username. |
| OTP and press 1 | Side products, mentioned once, sold through the admin rather than the public price list. |
| No KYC, crypto, five minutes, any SIP app | The storefront pitch from 21 September on. No identity, no contract, a login in a softphone. |
5. Screenshots
Caller-ID evidence
The channel posted two albums without captions, on 7 September at 19:17 and on 16 September at 21:19. Handset clocks are morning times, so the captures were made before the posts. Two files in the second album are byte-identical to files in the first: the Chase military number, and 877-922-2216.
Calls that displayed an institution name
Clock 7:45. Name displayed. Chase publishes this as Domestic Military Services. Reposted unchanged on 16 September.
Clock 7:35. Name displayed. Bank of America publishes this for home-equity servicing. A 2022 RoboKiller comment describes a fraud-department scam using this same number.
Clock 7:18. Name displayed. Citi’s main published service number is 800-374-9700. A third-party directory associates 877-357-3399 with a branch investment line. Treat the brand as what the phone showed.
Clock 7:24. Name displayed. PNC’s public personal-banking number is 888-762-2265. This review did not find 888-581-8960 on pnc.com.
Clock 7:27. Name displayed. M&T’s own account gives this number as customer service.
Clock 7:14. Name displayed. Huntington’s published service number is 800-480-2265. This review did not find 800-848-4070 on the bank’s site.
Calls that displayed digits only
Same handset. No CNAM string. No reliable public match was found for four toll-free numbers. 800-922-9999 is Citizens Bank’s published main number, and it did not display a name.
Clock 8:00. No name on the screen. Citizens publishes this as the customer-service center. It is also on BlackTail’s own list.
Clock 8:48. No name. Posted again, identical file, on 16 September. No confident public match in this review.
Clock 11:33. No name. Area code 573 is Missouri. No institution identified.
Clock 2:03. No name. No confident public match in this review.
Clock 2:13. No name. No confident public match in this review.
Clock 2:29. No name. No confident public match in this review.
Customer-submitted example
Same CLI as reported Google press-1 calls
Public reporting on 866-246-6453 describes automated calls that identify as Google Account Security and request a keypress. A February 2025 Reddit thread records that script from this number. YouMail’s directory lists “Google Account Security” voicemail text against it.
BlackTail lists the number as Google, and a customer forwarded a handset showing that presentation. The earlier public reports are not attributed to BlackTail. They show that this CLI is already used for that script.
6. Number list
Numbers posted on 23 September
On 23 September, after the instruction “MAKE NEW ACCOUNT ON THE BOT,” the channel posted the numbers below. The note says that if a main number fails, an alternate still displays the name. Labels are the channel’s. Navy Federal is classified here as a credit union.
The credit-union entries include geographic numbers as well as toll-free numbers: Credit Union 1 DeBarr (907, Alaska), SAFE Federal (803, South Carolina), and HawaiiUSA (808). Bank of Hawaii and First Hawaiian are on the bank list. Branch numbers remain usable when a national toll-free is blocked, and they present as local calls.
The 4 September advertisement named Capital One, Fifth Third, KeyBank, Barclays, and First Citizens. Those names are absent from the 23 September list. M&T appears in the advertisement and in the screenshots, and is absent from the 23 September list. The published set changes with route availability.
Banks and wealth
| Number | Their label |
|---|---|
| +1 (800) 289-3557 | Wells |
| +1 (800) 946-2626 | Wells |
| +1 (800) 678-7986 | Wells |
| +1 (800) 531-8722 | USAA |
| +1 (888) 751-9000 | TD Bank |
| +1 (844) 487-8478 | Truist |
| +1 (844) 375-7028 | Bank of America |
| +1 (888) 624-2323 | Bank of America |
| +1 (866) 564-2262 | Chase |
| +1 (800) 336-6675 | Chase |
| +1 (800) 872-2657 | US Bank |
| +1 (800) 922-9999 | Citizens Bank |
| +1 (800) 734-4667 | Regions |
| +1 (800) 352-2255 | PNC |
| +1 (800) 950-5114 | Citibank |
| +1 (888) 248-4226 | Citibank |
| +1 (800) 672-8739 | Comerica Bank |
| +1 (800) 266-3742 | Comerica Bank |
| +1 (800) 773-5601 | Beacon Bank |
| +1 (855) 342-3400 | First Interstate Bank |
| +1 (877) 838-2517 | Citizens & Northern Bank |
| +1 (888) 248-6423 | Flagstar Bank |
| +1 (888) 340-2265 | BMO |
| +1 (888) 643-3888 | Bank of Hawaii |
| +1 (888) 844-4444 | First Hawaiian Bank |
| +1 (877) 519-1403 | Charles Schwab |
| +1 (877) 247-2559 | Ally Bank |
| +1 (877) 768-2265 | Santander Bank |
| +1 (800) 277-2175 | SouthState Bank |
| +1 (800) 325-2265 | S&T Bank |
| +1 (800) 327-8376 | Eastern Bank |
| +1 (800) 480-2265 | Huntington National Bank |
Credit unions
| Number | Their label |
|---|---|
| +1 (888) 842-6328 | Navy Federal |
| +1 (907) 339-9485 | Credit Union 1, DeBarr branch |
| +1 (800) 242-2120 | Visions Federal Credit Union |
| +1 (800) 356-0067 | BrightBridge Credit Union |
| +1 (800) 999-2328 | Eastman Credit Union |
| +1 (803) 469-8600 | SAFE Federal Credit Union |
| +1 (844) 628-6969 | Municipal Credit Union |
| +1 (800) 999-5887 | Suncoast Credit Union |
| +1 (808) 534-4300 | HawaiiUSA Federal Credit Union |
| +1 (800) 942-9575 | Align Credit Union |
| +1 (800) 743-7228 | Arrowhead Credit Union |
| +1 (800) 538-3328 | Educational Employees Credit Union |
| +1 (800) 580-3300 | RBFCU |
| +1 (800) 642-4482 | Belco Community Credit Union |
| +1 (800) 328-8797 | Digital Federal Credit Union |
| +1 (800) 437-7328 | Canvas Credit Union |
| +1 (800) 456-4828 | Tinker Federal Credit Union |
| +1 (800) 475-1150 | Collins Community Credit Union |
| +1 (800) 525-9094 | Global Credit Union |
| +1 (800) 733-7233 | SAFE Credit Union |
| +1 (888) 732-8562 | State Employees’ Credit Union |
| +1 (877) 465-3361 | Golden 1 Credit Union |
| +1 (800) 462-8328 | SchoolsFirst Federal Credit Union |
Not banks
| Number | Their label |
|---|---|
| +1 (415) 906-3668 | Coinbase |
| +1 (844) 613-1499 | Coinbase |
| +1 (877) 763-9810 | |
| +1 (866) 246-6453 | Google — the number in the customer screenshot |
RBFCU has warned publicly that impersonators display 800-580-3300. That number is on this list. The warning does not name BlackTail.
7. Products
Live SIP, press-1, and OTP
Live seat, $40 per day
Advertised as unlimited minutes, one concurrent call, US and UK, on any SIP application. This is the product documented by the screenshots, the price list, the free tests, and the daily availability posts. In this market the product is called a manual SIP: an agent places the calls.
Offered once
On 13 September the channel stated: “We also have OTP and Press 1 available.” A press-1 campaign plays a recorded warning and connects callers who press 1 to an agent. The export contains no audio and no separate price. The Google number on the list is one already reported in that type of script.
Offered in the same post
An OTP service collects a one-time code, either by recording or through a live agent. It is offered and is not priced in the channel. The export contains no OTP script and no captured code.
Coinbase and Google appear on the same list as the banks. That set covers bank-account fraud, email and account recovery, and access to a cryptocurrency exchange. The channel is selling the telephony layer used for all three.
8. Pricing and balances
Advertised flat rate and metered balances
$35 / day
“Price starting from $35 per day.” On 20 September they describe this as the old rate.
$40 / day
One concurrent call. Sold as the premium-route price. Three days $100, seven days $240, a month $720.
$85 per week
Channel text: “3 weekly subs for 85 usd each from 100 usd.” A limited discount against a stated weekly price of $100.
The standing promotion is additional free time: one free day with a daily purchase, two with a weekly purchase, and six with a monthly purchase, plus occasional giveaways. Credit is added manually against the SIP username.
Counts are 100 application rows. One row shown as under $1 is a fraction of a cent. Because some SIP logins were registered more than once with different capitalisation, 57 rows with a positive balance correspond to 51 SIP accounts. Positive balances sum to $1,116.50. Net of the negative rows, the total is $1,112.48.
The three largest balances are jpcny $181.26, cougjhn $161.39, and alice $123.86. Several others sit just above the day rate ($40.17, $41.52, $42.48, $43.76, $43.78), which is consistent with a recent load and limited subsequent use. Other positive balances are residuals ($0.02, $0.06, $0.46, $0.82). Six rows are negative, the lowest at −$1.83.
An unmetered daily allowance would not leave balances of a few cents, and would not take accounts below zero during a call. These figures are consistent with prepaid credit reduced by call rating. The advertisement describes unlimited use. The ledger shows metering. The $40 figure is the price of a credit allocation.
9. Actors
Operators and customers named in the material
Identities in the channel
The export contains no company name, website, or address.
@BlackTailSip — the channel. Created 25 August 2026. The export header records 339 subscribers. Posts are sent as the channel, so the export does not provide a separate Telegram user id for the operator. author_43089211307.jpg is byte-identical to the channel image.
@blacktail_sipbot — the only bot linked from the channel. Some anchor text omits the underscore. The URL is t.me/blacktail_sipbot.
@wosh04 — named admin and support contact. Complimentary credit is issued through this account.
@zydex_p1 — addressee of the user-list post. Six panel accounts use zydex.local: Sado1234, lenda, cromutle, Max101010, 3arbi, and fbgbandzi70. Five of the six have a zero balance, which is consistent with operator or test accounts.
+44 7347 734470 — WhatsApp number posted on 18 September.
Messages forwarded into the channel
The channel reposts customer messages. The display names are the relevant content.
Rixh Off Persuasion — “Wow thank u,” after complimentary access. In this market, “persuasion” denotes the agent who conducts the social-engineering call.
Puppy boy Holding — thanks the operator for complimentary SIP access and supplied the Google screenshot. “Holding” denotes control of an account used to receive funds.
RockyHub.top Come Drops & CC's — “big respect VouchX100.” “Drops” are reshipping addresses. “CCs” are compromised payment cards. The display name is that of a carding shop, posted as a reference.
K㏌Ⓖ, x x, and Larped also acknowledge complimentary access. Larped’s message reads “Ty so much g Preacite u. Ur the goat.”
Selected application usernames
No signup IP is stored. A username is therefore not evidence of location. It records the label chosen for the account.
| Login | Relevance | Credit | SIP id |
|---|---|---|---|
| jpcny, cougjhn, alice | The three large leftover balances. alice’s SIP id, 774, predates the Telegram shop. | 181 / 161 / 124 | 976 / 957 / 774 |
| Jmailspoof | Username contains “spoof”. | 20.76 | 972 |
| CyberRobber | Legacy SIP id 662, balance below zero. | −0.51 | 662 |
| gogetterUK, ukkill, fastuk, JayUK | UK in the name. The first three are legacy SIP ids, and fastuk still has $62.67. JayUK was opened twice, different capitalisation, one SIP id. | 62.67 down to 0.82 | 690, 816, 811, 1010 |
| harryCanada | Canada in the name. Legacy SIP id, below zero. | −1.83 | 486 |
| neeUSA | USA in the name. Zero balance. | 0 | 992 |
| ROUTE1 – ROUTE4 | Four Gmail accounts opened between 20:56 and 21:02 UTC on 14 September. Treated as a route test by one party. | 0.02 to 1.00 | 993–996 |
| Chase1z, CREDIT, money666, VoIPWSL, Tonysip | Usernames refer to a bank, to credit, or to SIP. | low | 910 and others |
| Itzmeh | SIP id 127, the oldest id in the file, attached to an app login only on 16 September. | 9.45 | 127 |
| CarterJames5441 | Three app rows, one SIP id, identical $43.76. The app does not treat capitalisation as the same user. Magnus did. | 43.76 | 851 |
Video posted by the channel
Duration 10.7 seconds. Posted 10 September with an offer for the first ten new users. The subject holds a notepad on which “@BlackTail” is handwritten. No attempt was made to identify the person.
Duration 21.8 seconds. Posted 18 September without a caption. The filename is a YouTube download titled “Pick up the phone and start dialing,” a boiler-room scene. The same phrase appears in the channel’s own posts.
10. Account table
Deduplicated accounts
Each row is one application account. The source file repeats each account 129 times. Mail domains are shown. Full email addresses are omitted. Password hashes are bcrypt, one per account, and are omitted. Times are UTC. Credit is the wallet balance. Every wallet updatedAt falls within one second on 18 September 2026, from 12:07:59 to 12:08:00 UTC, which indicates a bulk write at export.
Seventeen SIP ids are below 844, the id of the first account created on 26 August, and therefore predate this application. Seventy-five ids were issued from 26 August onward. Eight further application rows are the same SIP user registered again with different capitalisation.
| Opened (UTC) | Username | Mail domain | SIP id | Credit USD | Note |
|---|---|---|---|---|---|
| 2026-09-12 15:54 | jpcny | gmail.com | 976 | 181.26 | Largest leftover credit |
| 2026-09-10 22:35 | cougjhn | cloudyourfast.net | 957 | 161.39 | Second-largest leftover credit |
| 2026-09-09 19:41 | alice | — | 774 | 123.86 | Third-largest leftover credit, legacy SIP id |
| 2026-09-02 15:49 | fastuk | — | 811 | 62.67 | UK in the name, legacy SIP id |
| 2026-09-17 20:04 | Janie1213 | — | 301 | 43.78 | Legacy SIP id, about one day of credit |
| 2026-09-02 14:12 | Carterjames5441 | — | 851 | 43.76 | Same SIP id as CarterJames5441 |
| 2026-08-27 18:32 | carterjames5441 | — | 851 | 43.76 | Same SIP id as CarterJames5441 |
| 2026-08-26 16:44 | CarterJames5441 | gmail.com | 851 | 43.76 | Three app rows, one SIP id |
| 2026-09-02 02:47 | SWthegreat | — | 752 | 42.48 | SIP id from before 26 Aug |
| 2026-08-31 17:38 | Smackservice21 | — | 506 | 41.52 | SIP id from before 26 Aug |
| 2026-09-05 22:04 | Rajendra1Savan | hotmail.com | 917 | 40.17 | |
| 2026-09-15 23:35 | VoIPWSL | — | 1004 | 38.74 | VoIP in the login |
| 2026-09-09 15:08 | amitRD | — | 765 | 27.08 | SIP id from before 26 Aug |
| 2026-08-31 02:45 | gogetterUK | — | 690 | 25.45 | UK in the name, legacy SIP id |
| 2026-09-12 02:28 | Jmailspoof | gmail.com | 972 | 20.76 | Username says spoof |
| 2026-08-28 16:14 | Arhaf5 | lisost.com | 870 | 19.02 | |
| 2026-08-31 18:29 | ukkill | — | 816 | 18.00 | UK in the name, legacy SIP id |
| 2026-09-09 18:59 | johnnndo33 | web-library.net | 945 | 16.70 | |
| 2026-09-12 19:37 | deadpoetsociety | — | 504 | 12.74 | SIP id from before 26 Aug |
| 2026-09-17 15:01 | Rats | gmail.com | 1022 | 11.72 | |
| 2026-09-02 14:56 | Koun01 | outlook.com | 903 | 11.00 | |
| 2026-08-31 15:26 | braveking | — | 777 | 10.48 | Shares a SIP id with another row |
| 2026-09-14 15:13 | Braveking | — | 777 | 10.48 | Shares a SIP id with another row |
| 2026-09-09 13:33 | Babyysixx | gmail.com | 942 | 9.78 | |
| 2026-09-16 16:21 | Itzmeh | — | 127 | 9.45 | Oldest SIP id in the file (127) |
| 2026-09-02 17:39 | Shivansh | gmail.com | 905 | 7.86 | Shares a SIP id with another row |
| 2026-09-04 18:18 | Shivansh | — | 905 | 7.86 | Shares a SIP id with another row |
| 2026-09-09 21:39 | hunter123 | gmail.com | 947 | 6.13 | |
| 2026-09-15 20:51 | Robertjonson925 | gmail.com | 1002 | 5.64 | |
| 2026-09-09 16:34 | Hellboy06 | gmail.com | 944 | 2.89 | |
| 2026-08-31 13:33 | ncjxkvjdhsbvf | emalupe.com | 887 | 1.75 | |
| 2026-08-30 23:29 | x0x01234 | — | 722 | 1.02 | SIP id from before 26 Aug |
| 2026-09-17 05:50 | fbgbandzi70 | zydex.local | 1018 | 1.00 | Internal zydex.local |
| 2026-09-17 09:02 | fuck | mod.com | 1020 | 1.00 | |
| 2026-09-17 22:07 | Max121211 | gmail.com | 1031 | 1.00 | |
| 2026-09-14 20:58 | ROUTE2 | gmail.com | 994 | 1.00 | One of four accounts opened in six minutes |
| 2026-09-14 21:01 | ROUTE3 | gmail.com | 995 | 1.00 | One of four accounts opened in six minutes |
| 2026-09-03 03:17 | Chase1z | gmail.com | 910 | 0.95 | Bank name in the login |
| 2026-09-11 15:26 | CREDIT | gmail.com | 965 | 0.90 | |
| 2026-09-09 05:57 | Max1212 | gmail.com | 937 | 0.84 | |
| 2026-09-17 15:18 | jayUK | — | 1010 | 0.82 | Same SIP id as JayUK |
| 2026-09-16 21:27 | JayUK | — | 1010 | 0.82 | UK in the name |
| 2026-09-17 21:45 | Crisp1212 | gmail.con | 1030 | 0.76 | |
| 2026-09-11 18:51 | Overrun | gmail.com | 969 | 0.72 | |
| 2026-09-04 15:14 | Neres | gmail.com | 915 | 0.69 | |
| 2026-09-14 20:56 | ROUTE1 | gmail.com | 993 | 0.66 | One of four accounts opened in six minutes |
| 2026-09-03 22:33 | Charlesstephh | gmail.com | 913 | 0.52 | |
| 2026-08-26 19:55 | Dseuringer | gmail.com | 854 | 0.46 | |
| 2026-09-02 17:11 | adw123 | gmail.com | 904 | 0.12 | |
| 2026-08-31 21:38 | gogo110 | gmail.com | 893 | 0.07 | |
| 2026-08-27 23:32 | Opera | gmail.com | 862 | 0.06 | Shares a SIP id with another row |
| 2026-09-02 10:45 | Opera | — | 862 | 0.06 | Shares a SIP id with another row |
| 2026-09-03 18:01 | Kaka9 | hotmail.it | 912 | 0.02 | |
| 2026-09-01 17:12 | money666 | gmail.com | 898 | 0.02 | |
| 2026-09-14 21:02 | ROUTE4 | gmail.com | 996 | 0.02 | One of four accounts opened in six minutes |
| 2026-08-31 16:38 | walt1 | gmail.com | 888 | 0.02 | |
| 2026-09-03 00:57 | bardin504 | outlook.com | 909 | 0.00 | |
| 2026-09-14 17:04 | 3arbi | zydex.local | 986 | 0.00 | Internal zydex.local |
| 2026-09-02 21:39 | 444dallaz | gmail.com | 908 | 0.00 | |
| 2026-09-08 08:46 | Ali121212 | gmail.com | 928 | 0.00 | |
| 2026-09-08 08:47 | Ali121212c | gmail.com | 929 | 0.00 | |
| 2026-09-04 13:22 | Allen1 | gmail.com | 914 | 0.00 | |
| 2026-08-27 05:53 | alone | dopiset.com | 855 | 0.00 | |
| 2026-09-01 21:15 | cromutle | zydex.local | 900 | 0.00 | Internal zydex.local |
| 2026-09-08 02:54 | daddyji | gmail.com | 926 | 0.00 | |
| 2026-09-06 02:03 | daxter | assistiva.org | 918 | 0.00 | |
| 2026-08-26 09:32 | doom1337 | gmail.com | 844 | 0.00 | First app account, 26 Aug |
| 2026-08-29 09:30 | Fahad12 | gmail.com | 874 | 0.00 | |
| 2026-09-09 22:58 | hanannn | gmail.com | 950 | 0.00 | |
| 2026-09-11 20:27 | Hollyking_2 | gmail.com | 971 | 0.00 | |
| 2026-08-28 14:25 | iconmanin | gmail.com | 869 | 0.00 | |
| 2026-09-03 15:52 | Jameswilly | — | 772 | 0.00 | SIP id from before 26 Aug |
| 2026-09-09 21:39 | jasonb | proton.me | 946 | 0.00 | |
| 2026-09-08 02:57 | Jugged | gmail.com | 927 | 0.00 | |
| 2026-08-27 14:39 | kapgotem | gmail.com | 856 | 0.00 | |
| 2026-08-28 23:50 | kenanyildiz0912 | gmail.com | 872 | 0.00 | |
| 2026-09-15 05:51 | Khorton1735 | gmail.com | 997 | 0.00 | |
| 2026-08-30 16:57 | lenda | zydex.local | 884 | 0.00 | Internal zydex.local |
| 2026-09-08 11:24 | MAJIBUTECH10 | gmail.con | 930 | 0.00 | |
| 2026-09-14 13:59 | mandy12q | gmail.com | 981 | 0.00 | |
| 2026-09-09 13:17 | Manuel10 | gmail.com | 941 | 0.00 | |
| 2026-08-30 10:32 | markdee | gmail.com | 882 | 0.00 | |
| 2026-08-26 10:11 | Mauricio | wuoting.com | 846 | 0.00 | |
| 2026-09-09 06:30 | Max101010 | zydex.local | 938 | 0.00 | Internal zydex.local |
| 2026-09-14 19:32 | neeUSA | — | 992 | 0.00 | USA in the name |
| 2026-08-29 12:07 | odek_design | gmail.com | 876 | 0.00 | |
| 2026-09-12 13:07 | olxbabulal | gmail.com | 973 | 0.00 | |
| 2026-09-11 12:51 | Ref1070 | gmail.com | 963 | 0.00 | |
| 2026-08-29 23:36 | Sado1234 | zydex.local | 880 | 0.00 | Internal zydex.local |
| 2026-08-29 11:41 | Srcompany570 | gmail.com | 875 | 0.00 | |
| 2026-09-15 21:55 | tonysip | — | 988 | 0.00 | Shares a SIP id with another row |
| 2026-09-14 17:35 | Tonysip | gmail.com | 988 | 0.00 | Shares a SIP id with another row |
| 2026-08-31 18:30 | Zoflavor | — | 716 | 0.00 | SIP id from before 26 Aug |
| 2026-09-09 22:00 | ZXRCVBJ | gmail.com | 948 | 0.00 | |
| 2026-09-01 07:29 | Testing101 | gmail.com | 894 | -0.21 | Test account, balance below zero |
| 2026-08-27 18:30 | agold658 | — | 858 | -0.24 | Shares a SIP id with another row |
| 2026-08-27 15:15 | AGold658 | icloud.com | 858 | -0.24 | Shares a SIP id with another row |
| 2026-09-13 14:45 | CyberRobber | — | 662 | -0.51 | Legacy SIP id, balance below zero |
| 2026-09-03 17:45 | Bconners77 | — | 152 | -0.99 | SIP id from before 26 Aug |
| 2026-08-31 19:13 | harryCanada | — | 486 | -1.83 | Canada in the name, legacy SIP id |
Mail domains across the 100 accounts: gmail.com 50, no email 28, zydex.local 6, outlook.com 2, gmail.con 2, and one each of hotmail.com, hotmail.it, icloud.com, proton.me, wuoting.com, dopiset.com, lisost.com, emalupe.com, assistiva.org, web-library.net, cloudyourfast.net, and mod.com. gmail.con is not a domain that receives mail.
11. Timeline
Channel activity and billing history
New application accounts per day, 26 August to 17 September. The peak is 12 accounts on 9 September. The database ends on 17 September. Channel posts continue through 27 September, so accounts opened after 17 September are absent from this table.
12. Information exposure
Material published in the channel
Posted in the channel
users_all.json (9.1 MB) was posted on 18 September with the caption “@zydex_p1 USER LIST”. It is the application account table. It contains 100 account ids, each repeated 129 times, including identical wallet timestamps. Counts in this assessment use 100. Every frequency in the raw file divides by 129.
Generated text, including two refusals
Posts through 20 September are short and informal, including “come win the day,” “eat it up,” and “95% of main numbers pass.” From 21 September a second, longer promotional style appears. On two occasions a model refusal was posted into the channel.
26 September, 04:31. “Not writing this one. A crypto-only, no-KYC unlimited VoIP service sold through a Telegram bot is a product profile that maps overwhelmingly to scam-call and robocall operations, and I won't write acquisition copy to grow its customer base.”
27 September, 07:45. “A $40/day VoIP product sold through a Telegram bot, crypto-only, no KYC, provisioned in five minutes, isn't a normal telephony offer — that configuration is the standard package for disposable numbers used in scam-call, OTP, and phishing operations, where ‘no KYC’ is the actual product.”
Promotional posts resume later on 27 September. The generated text did not replace the operator’s own messages. “Bot is up” posts continue alongside it.
Message ids in the export run from 1 to 150. Fifty-three ids are absent. Thirteen are missing on the morning of 18 September, between a repeated promotion and the video. Fifteen are missing between the WhatsApp post and the 20 September price change. The content of those messages is not in the export.
13. Market context
Geography and comparable services
Numbers on the working list belong to US institutions, plus Google and Coinbase. Both UK and US routes are advertised. The operator’s secondary contact is a UK mobile. Some usernames contain UK, Canada, or USA. Payment is cryptocurrency without an identity check, so the buyer is not required to be in the target country. The caller, the account receiving funds, and the trunk need not share a location. The shared components visible in this material are the Telegram bot and the SIP credential.
Blackpill P1, a separate Telegram press-1 channel, advertised in August 2025 that its SIP “passes any 18xx including 1888 and 1800, Google and more,” at $300 to enter and $0.16 per minute, alongside manual SIP. That is the same product category. No document in this export links @zydex_p1 or BlackTail to that channel. Open-web search did not find an indexed copy of the BlackTail channel.
“P1” is a label used by press-1 panels. Together with the single offer of press-1 and OTP, the Zydex name is consistent with a panel that can supply both a live seat and a campaign product. BlackTail is the live-seat brand given its own channel in late August 2026.
The channel image is a white line drawing of a scorpion on a black ground. The 24 September graphic is separate generated artwork using the phrases “global reach” and “no limits.” Neither identifies a legal entity. The export contains no website, postal address, or registered name.
14. Indicators
What the material supports
Calling numbers and destinations
On the dates of the screenshots, calls presenting the departmental numbers in the photographs reached a US handset with the institution name displayed. The same test applies to the 59 numbers on the 23 September list. The screenshots do not identify the carrier that signed the calls.
“Main numbers pass” is a claim that calls into those toll-free numbers complete. Relevant monitoring is volume and upstream reputation on calls into this list, including the branch numbers in Alaska (907), Hawaii (808), and South Carolina (803).
Departmental numbers require the same monitoring as the number printed on a card. The photographs include 877-469-0110 and 800-269-3084, secondary published numbers that still return the parent CNAM.
No trunk address in the export
The export contains no SIP host, server IP, upstream carrier, cryptocurrency address, call detail record, or called-party number. The signup-IP column exists and is empty. This file does not contain an address that can be blocked.
Identifiers that are present: @wosh04, @blacktail_sipbot, @BlackTailSip, @zydex_p1, and WhatsApp +44 7347 734470. Usernames in the account table are SIP logins on the billing platform. The platform’s user id had reached 1,031 by 17 September. This file contains 92 of those ids.
A one-channel prepaid service that posts a daily availability notice will change upstream more often than a single address remains useful. The stable indicators are the calling-number set, the one-channel day rate, and the Telegram storefront.
15. Limits of this assessment
Material not present, and lookups not run
| Item | Status |
|---|---|
| SIP server, trunk IP, upstream carrier, STIR/SHAKEN attestation | Not in the export. No infrastructure lookup was possible. Handset presentation is documented. The signalling that produced it is not. |
| Call detail, recordings, victim numbers, true call volume | Not in the export. Wallet credit is not minutes and not revenue. |
| Crypto wallets | Not in the channel text and not in the user file. |
| Signup IP and device fingerprint | Columns exist. All 100 values are null. Customers were not geolocated. IPinfo was not called because there was no IP to send. |
| Subscriber list behind the “339” | The export header has the count. It does not have the members. |
| 53 missing message ids between 1 and 150 | Treated as deleted or omitted. Content unknown. The largest clusters sit on 18 September and between 18 and 20 September. |
| Timezone of the channel clock | The export does not name it. Database times in this briefing are UTC. Channel times are as printed. |
| Two stickers, 14 and 18 September | WebM stickers with no caption. No frame was extracted. They are not treated as operational. |
| HLR / live network of +44 7347 734470 | Not run. Ofcom range holder only, from the January 2025 numbering notification. A different number in the same block, ending 4937, has an unrelated scam-call comment and is not this line. |
| Telegram numeric ids for @wosh04, @zydex_p1, and the bot | Not resolved. No Telegram API lookup. |
| rockyhub.top | Not opened. Used only as the display name of the account that vouched. |
| Password hashes | Present, bcrypt cost 12, 100 distinct. Not cracked, not reproduced. |
| Face in the 10 September video | Described. No face search, no name attached. |
| Whether 877-357-3399, 888-581-8960, and 800-848-4070 are assigned to Citi, PNC, and Huntington | The handset showed those names. The banks’ main published numbers are different, and this review did not confirm assignment. Four other toll-frees and the Missouri number had no confident match. |
| Blackpill P1 | Open-web context for the same product category, August 2025 posts. Not linked to this channel by any document in the export. |
| Activity after 17 September inside the panel | The leaked book stops there. The channel continues to 27 September, including “make a new account,” so later buyers are missing. |
Method
All anchored messages in messages.html were read. All 18 photographs were compared by hash; two files in the 16 September album match files in the 7 September album. Both videos were reviewed from the export thumbnails and duration metadata (10.7 seconds and 21.8 seconds). users_all.json was deduplicated on account id. Institution numbers were checked against pages published by Chase, Bank of America, M&T, and Citizens, and against the published Google Ads number, where such a page was found. Open-web search did not return an indexed copy of this channel. Full email addresses and password hashes are omitted.