On Wed, Mar 18, 2026 at 9:23 PM Jeff Brower <jbrower@signalogic.com> wrote:

Hi Aaron,

Is that a Twilio "Voice Trace" pcap you can download ? I thought those were for Twilio support engineer / internal viewing only. Or are the ones you mention called something else ?

-Jeff

Quoting "Aaron C. de Bruyn via VoiceOps" <voiceops@voiceops.org>:

I forgot Twilio lets you download PCAPs of calls.

I grabbed one at random:
P-Asserted-Identity: <sip:+14632018300@206.147.72.38:5060>
SIP PAI Address: sip:+14632018300@206.147.72.38:5060
SIP PAI User Part: +14632018300
E.164 number (MSISDN): 14632018300
SIP PAI Host Part: 206.147.72.38
SIP PAI Host Port: 5060

-A

On Wed, Mar 18, 2026 at 8:44 AM Aaron C. de Bruyn <aaron@heyaaron.com> wrote:

I did NOT know that. :)
I'm not a telco or service provider. Just part of a company that's unfortunate enough to help a handful of customers manage their own internal Asterisk or FreePBX systems.

Most of my customers use Twilio upstream. I don't think Twilio logs that header, and I don't see anything like it in the Asterisk logs. (Not sure if it even gets passed to us or if it just doesn't logs it.)

-A

On Wed, Mar 18, 2026 at 8:36 AM Mark R Lindsey <lindsey@e-c-group.com> wrote:

So...did you get any Identity headers? A traceback with ITG, or maybe an Identity header, is your only hope for tracing the origin.

I'm including the below, not to say that you, Aaron, don't know this, but just in case it's valuable to anyone else reading:

In the case of your first number, it belongs to a thousand block assigned initially to Bandwidth.com...but that's not even meaningful for routing a call to them today. You'd have to do an LRN lookup to find out how to deliver a call back to the legitimate owner of this number.

I did an LRN lookup for that first one, and it's currently ported to Onvoy, one of the brands of Sinch. But again, that only tells us how to get a call TO that legitimate owner.

What you want to know is how they're sending calls to you. And if you're getting an Identity header it would be at least interesting.

Failing that, you can file a report with the Industry Traceback Group to report illegal calls:

https://tracebacks.org/traceback-requests/

Mark R Lindsey | +1-229-316-0013 | mrl@ecg.co | LinkedIn

On Mar 18, 2026, at 11:22, Aaron C. de Bruyn via VoiceOps <voiceops@voiceops.org> wrote:

A bunch of numbers out of Indiana have been spamming my customers for about a week.

Most are automated recordings about how your Google business listing is wrong and needs to be fixed so customers can find you. Sometimes it's a human prefixed by the telltale "BWOOP" sound.

+14632000068 - BANDWIDTH.COM CLEC LLC IN
+14632001925 - BANDWIDTH.COM CLEC LLC IN
+14632004002 - BANDWIDTH.COM CLEC LLC IN
+14632005772 - BANDWIDTH.COM CLEC LLC IN
+14632006038 - BANDWIDTH.COM CLEC LLC IN
+14632006422 - BANDWIDTH.COM CLEC LLC IN
+14632006730 - BANDWIDTH.COM CLEC LLC IN
+14632009587 - BANDWIDTH.COM CLEC LLC IN
+14632018300 - BHN IP ENABLED SERVICES LLC
+14632018413 - BHN IP ENABLED SERVICES LLC
+14632018586 - BHN IP ENABLED SERVICES LLC
+14632018682 - BHN IP ENABLED SERVICES LLC
+14632027042 - LEVEL 3 COMMUNICATIONS LLC IN (Lumen)
+14632027073 - LEVEL 3 COMMUNICATIONS LLC IN (Lumen)
+14632027200 - LEVEL 3 COMMUNICATIONS LLC IN (Lumen)
+14632027252 - LEVEL 3 COMMUNICATIONS LLC IN (Lumen)
+14632027397 - LEVEL 3 COMMUNICATIONS LLC IN (Lumen)
+14632027539 - LEVEL 3 COMMUNICATIONS LLC IN (Lumen)
+14632027678 - LEVEL 3 COMMUNICATIONS LLC IN (Lumen)
+14632027899 -LEVEL 3 COMMUNICATIONS LLC IN (Lumen)
+14632030946 - METROPCS INC (T-Mobile US)

Kinda hard to believe the big boys haven't caught this abuse of their network yet.

I tried reporting the numbers to bandwidth.com (as ID'd by telcodata.us), but their form only allows for a single entry at a time, and it says most of the numbers don't belong to them. Either their form is broken or telcodata.us is out of date.

I can't find a reporting for Level3/Lumen. They seem to be geared towards "I'm a customer and need help figuring out the star code to block calls".

-A

_______________________________________________
VoiceOps mailing list -- VoiceOps@voiceops.org
https://lists.voiceops.org/postorius/lists/voiceops.voiceops.org/
To unsubscribe send an email to voiceops-leave@voiceops.org