We already had that in our "block expensive" list in the switch, so I assume it's been in our decks for a while. It was last updated two months ago. We use Onvoy primarily. On Tue, Aug 4, 2015 at 11:34 AM Ryan Delgrosso <ryandelgrosso at gmail.com> wrote:

All, We have seen a Caribbean NPANXX (1-268-762) advertised to us from a US tier 1 vendor. It has drawn a large amount of fraudulent traffic.

We first saw this prefix pop up in this vendors rate decks in April. Going back to the start of the year I cannot find it in any revision of the LERG though, and no other vendor I have offers routes/pricing to this prefix.

Does anybody know whats going on here?

Shouldn't any zone 1 prefix exist in the LERG months prior to going live, or at the very least within some reasonable time after showing up for live traffic?

Does this smell like highjacking to anyone else?

All our vendor will tell is they are getting the route from another T1 vendor, but in my 20+ connected peers I cannot find another occurrence.

Any help or guidance is much appreciated. Feel free to reply on or off list.

-Ryan _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops

Here is what we know about 1-268-762. On July 22, 2014, Telstra reported 1268762015 to the list maintained by the GSMA Fraud and Security Group. On Sept. 1, 2014, we recorded that 12687620310 was a premium rate test number advertised by www.cyclone.li On Sept. 1, 2014, we recorded that 12687620001 was a premium rate test number advertised by iprn.me. This website is no longer available. Jim D. -----Original Message----- From: VoiceOps [mailto:voiceops-bounces at voiceops.org] On Behalf Of Ryan Delgrosso Sent: Tuesday, August 04, 2015 2:34 PM To: voiceops at voiceops.org Subject: [VoiceOps] Suspect NPANXX question All, We have seen a Caribbean NPANXX (1-268-762) advertised to us from a US tier 1 vendor. It has drawn a large amount of fraudulent traffic. We first saw this prefix pop up in this vendors rate decks in April. Going back to the start of the year I cannot find it in any revision of the LERG though, and no other vendor I have offers routes/pricing to this prefix. Does anybody know whats going on here? Shouldn't any zone 1 prefix exist in the LERG months prior to going live, or at the very least within some reasonable time after showing up for live traffic? Does this smell like highjacking to anyone else? All our vendor will tell is they are getting the route from another T1 vendor, but in my 20+ connected peers I cannot find another occurrence. Any help or guidance is much appreciated. Feel free to reply on or off list. -Ryan _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops