Hi Folks, We are seeing something strange coming across our network. A disconnected client TFN is receiving 30,000+ calls per hour (all failing). The ANIs being used are dummy ANIs 17029983416 (no answer) and 16469820093 (recording saying "no routes found"). This is not affecting our network, although it's causing the upstream provider a bit of grief. Not sure why someone would do this.... We are about to remove the CICs at the sms800 level, but just wondering if anyone has come across something similar? Thanks, Ivan
Sounds like a possible loop, the "No Routes Found" recording comes off of a Sonus Networks GSX or SBC. How is the TFN arriving to your network? - Chris On 24 Feb 2014, at 9:01, Ivan Kovacevic wrote:
Hi Folks,
We are seeing something strange coming across our network. A disconnected client TFN is receiving 30,000+ calls per hour (all failing). The ANIs being used are dummy ANIs 17029983416 (no answer) and 16469820093 (recording saying "no routes found").
This is not affecting our network, although it's causing the upstream provider a bit of grief.
Not sure why someone would do this.... We are about to remove the CICs at the sms800 level, but just wondering if anyone has come across something similar?
Thanks,
Ivan _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
I would just block the originating IP address. It would appear to me someone is trying to compromise your system. -----Original Message----- From: VoiceOps [mailto:voiceops-bounces at voiceops.org] On Behalf Of Christopher Aloi Sent: Monday, February 24, 2014 9:44 AM To: Ivan Kovacevic Cc: voiceops at voiceops.org Subject: Re: [VoiceOps] Voice DDOS ? Sounds like a possible loop, the "No Routes Found" recording comes off of a Sonus Networks GSX or SBC. How is the TFN arriving to your network? - Chris On 24 Feb 2014, at 9:01, Ivan Kovacevic wrote:
Hi Folks,
We are seeing something strange coming across our network. A disconnected client TFN is receiving 30,000+ calls per hour (all failing). The ANIs being used are dummy ANIs 17029983416 (no answer) and 16469820093 (recording saying "no routes found").
This is not affecting our network, although it's causing the upstream provider a bit of grief.
Not sure why someone would do this.... We are about to remove the CICs at the sms800 level, but just wondering if anyone has come across something similar?
Thanks,
Ivan _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
Calls are coming to us via L3 (along with all the legitimate traffic) so simple IP block won't be helpful. We've disconnected the number to make it stop... but this is only possible because the number was not in use. If it was an active number, we wouldn't have this option. Just chatting with L3 to see what options they have for this type of scenario. Best Regards, Ivan -----Original Message----- From: John Curry [mailto:John at InteleChoice.us] Sent: Monday, February 24, 2014 9:51 AM To: 'Christopher Aloi'; 'Ivan Kovacevic' Cc: voiceops at voiceops.org Subject: RE: [VoiceOps] Voice DDOS ? I would just block the originating IP address. It would appear to me someone is trying to compromise your system. -----Original Message----- From: VoiceOps [mailto:voiceops-bounces at voiceops.org] On Behalf Of Christopher Aloi Sent: Monday, February 24, 2014 9:44 AM To: Ivan Kovacevic Cc: voiceops at voiceops.org Subject: Re: [VoiceOps] Voice DDOS ? Sounds like a possible loop, the "No Routes Found" recording comes off of a Sonus Networks GSX or SBC. How is the TFN arriving to your network? - Chris On 24 Feb 2014, at 9:01, Ivan Kovacevic wrote:
Hi Folks,
We are seeing something strange coming across our network. A disconnected client TFN is receiving 30,000+ calls per hour (all failing). The ANIs being used are dummy ANIs 17029983416 (no answer) and 16469820093 (recording saying "no routes found").
This is not affecting our network, although it's causing the upstream provider a bit of grief.
Not sure why someone would do this.... We are about to remove the CICs at the sms800 level, but just wondering if anyone has come across something similar?
Thanks,
Ivan _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
Per level3 this is called toll free pumping Their Fraud deptt will give you an FBI noticed about this & say they cannot track the source Ujjval K
On Feb 24, 2014, at 7:54 AM, Ivan Kovacevic <ivan.kovacevic at startelecom.ca> wrote:
Calls are coming to us via L3 (along with all the legitimate traffic) so simple IP block won't be helpful. We've disconnected the number to make it stop... but this is only possible because the number was not in use.
If it was an active number, we wouldn't have this option. Just chatting with L3 to see what options they have for this type of scenario.
Best Regards,
Ivan
-----Original Message----- From: John Curry [mailto:John at InteleChoice.us] Sent: Monday, February 24, 2014 9:51 AM To: 'Christopher Aloi'; 'Ivan Kovacevic' Cc: voiceops at voiceops.org Subject: RE: [VoiceOps] Voice DDOS ?
I would just block the originating IP address. It would appear to me someone is trying to compromise your system.
-----Original Message----- From: VoiceOps [mailto:voiceops-bounces at voiceops.org] On Behalf Of Christopher Aloi Sent: Monday, February 24, 2014 9:44 AM To: Ivan Kovacevic Cc: voiceops at voiceops.org Subject: Re: [VoiceOps] Voice DDOS ?
Sounds like a possible loop, the "No Routes Found" recording comes off of a Sonus Networks GSX or SBC.
How is the TFN arriving to your network?
- Chris
On 24 Feb 2014, at 9:01, Ivan Kovacevic wrote:
Hi Folks,
We are seeing something strange coming across our network. A disconnected client TFN is receiving 30,000+ calls per hour (all failing). The ANIs being used are dummy ANIs 17029983416 (no answer) and 16469820093 (recording saying "no routes found").
This is not affecting our network, although it's causing the upstream provider a bit of grief.
Not sure why someone would do this.... We are about to remove the CICs at the sms800 level, but just wondering if anyone has come across something similar?
Thanks,
Ivan _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
Via L3. Best Regards, Ivan Kovacevic Star Telecom | www.startelecom.ca | SIP Based Services for Contact Centers -----Original Message----- From: Christopher Aloi [mailto:ctaloi at gmail.com] Sent: Monday, February 24, 2014 9:44 AM To: Ivan Kovacevic Cc: voiceops at voiceops.org Subject: Re: [VoiceOps] Voice DDOS ? Sounds like a possible loop, the "No Routes Found" recording comes off of a Sonus Networks GSX or SBC. How is the TFN arriving to your network? - Chris On 24 Feb 2014, at 9:01, Ivan Kovacevic wrote:
Hi Folks,
We are seeing something strange coming across our network. A disconnected client TFN is receiving 30,000+ calls per hour (all failing). The ANIs being used are dummy ANIs 17029983416 (no answer) and 16469820093 (recording saying "no routes found").
This is not affecting our network, although it's causing the upstream provider a bit of grief.
Not sure why someone would do this.... We are about to remove the CICs at the sms800 level, but just wondering if anyone has come across something similar?
Thanks,
Ivan _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
participants (4)
-
ctaloi＠gmail.com -
ivan.kovacevic＠startelecom.ca -
John＠InteleChoice.us -
ujjval＠simplesignal.com