Hello Everyone, We've been seeing a lot of strange inbound calls to our toll free numbers recently. The only thing they have in common is the caller ID text is always a city and a state. And the the call duration is 60 seconds on the dot..Every time. Considering they are calling toll free numbers I assume this is some kind of fraud attempt. IE. Calling tons of random Toll Free numbers so the terminating carrier pays the originator..etc. Anyone else seeing this? Anything we can do to stop these? Here's what our CDR looks like, These are just the calls to our Corp Toll free. But we are seeing them toward customer toll free as well. 9/1/2013 13:39:02,"CARLSBAD CA" <4423334358>,4423334358,8553577333,60,60,ANSWERED,Incoming9/1/2013 16:20:30,"WEST BLOCTON AL" <2056368142>,2056368142,8553577333,60,60,ANSWERED,Incoming9/6/2013 07:18:18,"HUNTNGTN PRK CA" <3232825216>,3232825216,8553577333,60,60,ANSWERED,Incoming9/7/2013 11:54:09,"FORT SMITH AR" <4796682810>,4796682810,8553577333,60,60,ANSWERED,Incoming9/7/2013 23:14:35,"TUCSON AZ" <5203326555>,5203326555,8553577333,60,60,ANSWERED,Incoming9/9/2013 19:06:00,"WARRIOR AL" <2052891452>,2052891452,8553577333,60,60,ANSWERED,Incoming9/9/2013 20:23:49,"SAN RAFAEL CA" <4155240522>,4155240522,8553577333,60,60,ANSWERED,Incoming9/25/2013 17:01:09,"FRESNO CA" <5595499612>,5595499612,8553577333,60,60,ANSWERED,Incoming9/25/2013 22:41:29,"MOBILE AL" <2515454388>,2515454388,8553577333,60,60,ANSWERED,Incoming9/26/2013 00:01:35,"PINSON AL" <2056834147>,2056834147,8553577333,60,60,ANSWERED,Incoming9/26/2013 03:13:53,"PHENIX CITY AL" <3344685267>,3344685267,8553577333,60,60,ANSWERED,Incoming9/26/2013 22:38:21,"GUNTERSVILLE AL" <2562934038>,2562934038,8553577333,60,60,ANSWERED,Incoming9/27/2013 11:29:58,"MIAMI AZ" <9284731203>,9284731203,8553577333,60,60,ANSWERED,Incoming9/27/2013 20:12:43,"ALBERTVILLE AL" <2564002365>,2564002365,8553577333,60,60,ANSWERED,Incoming9/30/2013 02:07:15,"HUNTSVILLE AL" <2562174709>,2562174709,8553577333,60,60,ANSWERED,Incoming9/30/2013 06:55:16,"CHASE CITY VA" <4345334010>,4345334010,8553577333,60,60,ANSWERED,Incoming10/2/2013 02:23:12,"LOS ANGELES CA" <2134555680>,2134555680,8553577333,60,60,ANSWERED,Incoming Nick Olsen Network Operations (855) FLSPEED x106
On 10/2/13 10:13 AM, Nick Olsen wrote:
Hello Everyone,
We've been seeing a lot of strange inbound calls to our toll free numbers recently. The only thing they have in common is the caller ID text is always a city and a state. And the the call duration is 60 seconds on the dot..Every time.
Are the calls answered by a human? If so, what do they hear? If not and it's an IVR, if you call and say nothing does the call drop in 60 seconds? City and state are not uncommon for CNAM. Many CNAM providers will put the city and state of the rate center for the NPA-NXX if caller name isn't available. -- Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV
I randomly choose a few numbers to check our CDR data and I see that 2564002365 called a customer of ours normal TN and one customer's toll free number.
9/27/2013 20:12:43,"ALBERTVILLE AL" <2564002365>,2564002365,8553577333,60,60,ANSWERED,Incoming
When I call the number 2564002365 it answers and immediately hangs up on me. It reminds me of an asterisk like thing where I have made a mistake in my config but this is intentional? Randomly checking a few numbers they seem to belong to Level3 if they have not ported. Call them up and complain? Maybe in some wierd bizzaro world they might actually do something about it. matt at g4.net On Wed, 2 Oct 2013, Nick Olsen wrote:
Hello Everyone, We've been seeing a lot of strange inbound calls to our toll free numbers recently. The only thing they have in common is the caller ID text is always a city and a state. And the the call duration is 60 seconds on the dot..Every time.
Considering they are calling toll free numbers I assume this is some kind of fraud attempt. IE. Calling tons of random Toll Free numbers so the terminating carrier pays the originator..etc.
Anyone else seeing this? Anything we can do to stop these? Here's what our CDR looks like, These are just the calls to our Corp Toll free. But we are seeing them toward customer toll free as well.
9/1/2013 13:39:02,"CARLSBAD CA" <4423334358>,4423334358,8553577333,60,60,ANSWERED,Incoming 9/1/2013 16:20:30,"WEST BLOCTON AL" <2056368142>,2056368142,8553577333,60,60,ANSWERED,Incoming 9/6/2013 07:18:18,"HUNTNGTN PRK CA" <3232825216>,3232825216,8553577333,60,60,ANSWERED,Incoming 9/7/2013 11:54:09,"FORT SMITH AR" <4796682810>,4796682810,8553577333,60,60,ANSWERED,Incoming 9/7/2013 23:14:35,"TUCSON AZ" <5203326555>,5203326555,8553577333,60,60,ANSWERED,Incoming 9/9/2013 19:06:00,"WARRIOR AL" <2052891452>,2052891452,8553577333,60,60,ANSWERED,Incoming 9/9/2013 20:23:49,"SAN RAFAEL CA" <4155240522>,4155240522,8553577333,60,60,ANSWERED,Incoming 9/25/2013 17:01:09,"FRESNO CA" <5595499612>,5595499612,8553577333,60,60,ANSWERED,Incoming 9/25/2013 22:41:29,"MOBILE AL" <2515454388>,2515454388,8553577333,60,60,ANSWERED,Incoming 9/26/2013 00:01:35,"PINSON AL" <2056834147>,2056834147,8553577333,60,60,ANSWERED,Incoming 9/26/2013 03:13:53,"PHENIX CITY AL" <3344685267>,3344685267,8553577333,60,60,ANSWERED,Incoming 9/26/2013 22:38:21,"GUNTERSVILLE AL" <2562934038>,2562934038,8553577333,60,60,ANSWERED,Incoming 9/27/2013 11:29:58,"MIAMI AZ" <9284731203>,9284731203,8553577333,60,60,ANSWERED,Incoming 9/27/2013 20:12:43,"ALBERTVILLE AL" <2564002365>,2564002365,8553577333,60,60,ANSWERED,Incoming 9/30/2013 02:07:15,"HUNTSVILLE AL" <2562174709>,2562174709,8553577333,60,60,ANSWERED,Incoming 9/30/2013 06:55:16,"CHASE CITY VA" <4345334010>,4345334010,8553577333,60,60,ANSWERED,Incoming 10/2/2013 02:23:12,"LOS ANGELES CA" <2134555680>,2134555680,8553577333,60,60,ANSWERED,Incoming
Nick Olsen Network Operations (855) FLSPEED? x106
[emaillogo.jpg]
You could block the numbers at sms800 level or block them at your switch translations. Erik On Wed, Oct 2, 2013 at 8:36 AM, Matt Yaklin <myaklin at g4.net> wrote:
I randomly choose a few numbers to check our CDR data and I see that 2564002365 called a customer of ours normal TN and one customer's toll free number.
9/27/2013 20:12:43,"ALBERTVILLE AL" <2564002365>,2564002365,**
8553577333,60,60,ANSWERED,**Incoming
When I call the number 2564002365 it answers and immediately hangs up on me. It reminds me of an asterisk like thing where I have made a mistake in my config but this is intentional?
Randomly checking a few numbers they seem to belong to Level3 if they have not ported.
Call them up and complain? Maybe in some wierd bizzaro world they might actually do something about it.
matt at g4.net
On Wed, 2 Oct 2013, Nick Olsen wrote:
Hello Everyone,
We've been seeing a lot of strange inbound calls to our toll free numbers recently. The only thing they have in common is the caller ID text is always a city and a state. And the the call duration is 60 seconds on the dot..Every time.
Considering they are calling toll free numbers I assume this is some kind of fraud attempt. IE. Calling tons of random Toll Free numbers so the terminating carrier pays the originator..etc.
Anyone else seeing this? Anything we can do to stop these? Here's what our CDR looks like, These are just the calls to our Corp Toll free. But we are seeing them toward customer toll free as well.
9/1/2013 13:39:02,"CARLSBAD CA" <4423334358>,4423334358,** 8553577333,60,60,ANSWERED,**Incoming 9/1/2013 16:20:30,"WEST BLOCTON AL" <2056368142>,2056368142,** 8553577333,60,60,ANSWERED,**Incoming 9/6/2013 07:18:18,"HUNTNGTN PRK CA" <3232825216>,3232825216,** 8553577333,60,60,ANSWERED,**Incoming 9/7/2013 11:54:09,"FORT SMITH AR" <4796682810>,4796682810,** 8553577333,60,60,ANSWERED,**Incoming 9/7/2013 23:14:35,"TUCSON AZ" <5203326555>,5203326555,** 8553577333,60,60,ANSWERED,**Incoming 9/9/2013 19:06:00,"WARRIOR AL" <2052891452>,2052891452,** 8553577333,60,60,ANSWERED,**Incoming 9/9/2013 20:23:49,"SAN RAFAEL CA" <4155240522>,4155240522,** 8553577333,60,60,ANSWERED,**Incoming 9/25/2013 17:01:09,"FRESNO CA" <5595499612>,5595499612,** 8553577333,60,60,ANSWERED,**Incoming 9/25/2013 22:41:29,"MOBILE AL" <2515454388>,2515454388,** 8553577333,60,60,ANSWERED,**Incoming 9/26/2013 00:01:35,"PINSON AL" <2056834147>,2056834147,** 8553577333,60,60,ANSWERED,**Incoming 9/26/2013 03:13:53,"PHENIX CITY AL" <3344685267>,3344685267,** 8553577333,60,60,ANSWERED,**Incoming 9/26/2013 22:38:21,"GUNTERSVILLE AL" <2562934038>,2562934038,** 8553577333,60,60,ANSWERED,**Incoming 9/27/2013 11:29:58,"MIAMI AZ" <9284731203>,9284731203,** 8553577333,60,60,ANSWERED,**Incoming 9/27/2013 20:12:43,"ALBERTVILLE AL" <2564002365>,2564002365,** 8553577333,60,60,ANSWERED,**Incoming 9/30/2013 02:07:15,"HUNTSVILLE AL" <2562174709>,2562174709,** 8553577333,60,60,ANSWERED,**Incoming 9/30/2013 06:55:16,"CHASE CITY VA" <4345334010>,4345334010,** 8553577333,60,60,ANSWERED,**Incoming 10/2/2013 02:23:12,"LOS ANGELES CA" <2134555680>,2134555680,** 8553577333,60,60,ANSWERED,**Incoming
Nick Olsen Network Operations (855) FLSPEED x106
[emaillogo.jpg]
_______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
participants (4)
-
erik＠eespro.com -
jay＠west.net -
myaklin＠g4.net -
nick＠flhsi.com