Case File · Jul 2026

Operation GX4EWF00

Stock-scam SMS network. One vetted 10DLC campaign shared across shell brands. A founder who knew, in writing. Evidence preserved before takedown — and the operation is still sending.

Request the evidence room →← Back to overview
108,107
Texts delivered
73,943
Unique victims extracted
46
Sender numbers rotated
$54–162M
Statutory exposure range
Structure

One campaign, two shell brands

A NY-based sending platform provides the dashboard, campaigns, and "compliance" features. A national CPaaS gateway is plugged in via the platform's own "Bring Your Own Gateway" plan — the gateway transmits the texts, provisions the numbers, and approved the 10DLC campaign. That single registration (group GX4EWF00) was shared across multiple platform sub-accounts. Both companies profited from the same operation.

PartyRoleEvidence hookExposure
Operator (unnamed)Direct senderAccounts, templates, lead listsTCPA direct liability
Two shell LLCsShell brandsGateway sub-group recordsJudgment-proof by design
National CPaaS gatewayGateway + 10DLC approverOne group, two brands, founder's emailKnowing facilitation
NY-based sending platformSending platformOwn 'High Opt-out Rate' flags; BYOG plan $199/moVisible harm, kept service
Wholesale carrierOriginating carrierThousands-block attributionCarrier notice recipient
Actual knowledge

The willfulness record, hour by hour

When (2026, ET)What happenedSignificance
Jul 21, 10:44 PMDetailed TCPA complaint delivered to the gatewayFormal notice created
Jul 21, 10:57 PMEscalated directly to founders' inboxesNo plausible deniability
Jul 21, 11:28 PMFounder replies: admits termination capability, kills one scam accountKnowledge + capability, in writing
Jul 21, same dayThis operation blasts 28,037 texts in 8 batchesLeft running on the same gateway
Jul 22+Platform-wide audit demanded; never conductedWillful blindness
Jul 23, 2:00 PMFresh 2,500-recipient blast — one day after evidence extractionUndeterred
Jul 24Re-probe: 80,875 delivered / 30 days; 6.2% opt-out; second account's credentials rotatedStill live; spoliation signal
Aug 8 / 10Sender numbers renewed; billing continuedKnowing facilitation continues

Evidence room available to counsel

Victim list (73,943 deduplicated), founder's email thread, delivery analytics, platform architecture proof, plaintiff declaration template, and a live investigation dashboard.

Request access →