Why do rogue callers want to call the UK

Hi there


A bit of Analog style log processing;
http://www.sput.nl/asterisk/#req
Of you strip leading stuff like '00' and '011', you end up with numbers
like 442035199055 and 442035199098. And most of the originating IP
addresses are US.
So why are Americans so keen on free calls to the UK (esp London)?


Regards,
Rob
--
Wim T. Schippers for president
http://nl.wikipedia.org/wiki/Bestand..._Drienerlo.jpg

Rob van der Putten (for it is he) wrote:

> A bit of Analog style log processing;
> http://www.sput.nl/asterisk/#req
> Of you strip leading stuff like '00' and '011', you end up with numbers
> like 442035199055 and 442035199098. And most of the originating IP
> addresses are US.
> So why are Americans so keen on free calls to the UK (esp London)?

Perhaps the numbers they're attempting to contact are under their control,
in order to verify that they've found a vulnerable system [I see something
similar in Apache logs from various web servers I look after]. And perhaps
throwaway UK DDIs are easier to get hold of than anything else.

--
<http://ale.cx/> (AIM:troffasky) (UnSoEsNpEaTm@ale.cx)
14:39:06 up 64 days, 20:55, 1 user, load average: 0.05, 0.16, 0.16
"People believe any quote they read on the internet
if it fits their preconceived notions." - Martin Luther King

Hi there


alexd wrote:

> Perhaps the numbers they're attempting to contact are under their control,
> in order to verify that they've found a vulnerable system [I see something
> similar in Apache logs from various web servers I look after]. And perhaps
> throwaway UK DDIs are easier to get hold of than anything else.

Wikipedia on DDI;
http://en.wikipedia.org/wiki/Direct_Dial-In#Sellers
"UK Geographic DID numbers can be obtained for free, terminated over SIP
and also generate a revenue for inbound traffic."
That's almost a pink contract.


Regards,
Rob
--
Wim T. Schippers for president
http://nl.wikipedia.org/wiki/Bestand..._Drienerlo.jpg

On 26/10/2011 17:40, Rob van der Putten wrote:
> Hi there
>
>
> alexd wrote:
>
>> Perhaps the numbers they're attempting to contact are under their
>> control,
>> in order to verify that they've found a vulnerable system [I see
>> something
>> similar in Apache logs from various web servers I look after]. And
>> perhaps
>> throwaway UK DDIs are easier to get hold of than anything else.
>
> Wikipedia on DDI;
> http://en.wikipedia.org/wiki/Direct_Dial-In#Sellers
> "UK Geographic DID numbers can be obtained for free, terminated over SIP
> and also generate a revenue for inbound traffic."
> That's almost a pink contract.
>
>
> Regards,
> Rob

I'm not sure how you can generate revenue by getting people to dial your
UK *geographic* number, although I take your point that UK geo and NGNs
seem to be more widely available than any other country.


--

Graham.

%Profound_observation%

Graham. (for it is he) wrote:

> I'm not sure how you can generate revenue by getting people to dial your
> UK *geographic* number, although I take your point that UK geo and NGNs
> seem to be more widely available than any other country.

Perhaps *you* can't, but someone with enough scale can, although I don't
think that's what's happening here.

--
<http://ale.cx/> (AIM:troffasky) (UnSoEsNpEaTm@ale.cx)
13:33:29 up 65 days, 19:49, 1 user, load average: 0.04, 0.16, 0.21
"People believe any quote they read on the internet
if it fits their preconceived notions." - Martin Luther King

Rob van der Putten <rob@sput.nl> wrote in <4ea73720$0$1307$e4fe514c@dreader23.news.xs4all.nl >:

> A bit of Analog style log processing;
> http://www.sput.nl/asterisk/#req
> Of you strip leading stuff like '00' and '011', you end up with numbers
> like 442035199055 and 442035199098.

I had a look at the attempts I logged on an asterisk server and while I did
notice the attempts to reach UK numbers in a likewise pattern I can't find
any attempts to reach the exact same numbers.

Either there are a lot of attackers trying this or they select a UK number,
give it a few tries and drop it immediately.

For added fun I answer those calls, play a random 'this number is not in
service' recording from somewhere around the world .. and I record the
incoming and outgoing audio. Sofar this got me a recording of a lot of
noise: http://idefix.net/~koos/newsitem.cgi/1311000729

Koos

--
Koos van den Hout, PGP keyid DSS/1024 0xF0D7C263 via keyservers
koos@kzdoos.xs4all.nl IPv6: Think ::/0, act ::1.
http://idefix.net/ Are you ready to switch to IPv6?

Koos van den Hout wrote:

> Either there are a lot of attackers trying this or they select a UK number,
> give it a few tries and drop it immediately.
>
> For added fun I answer those calls, play a random 'this number is not in
> service' recording from somewhere around the world .. and I record the
> incoming and outgoing audio. Sofar this got me a recording of a lot of
> noise: http://idefix.net/~koos/newsitem.cgi/1311000729

I just play them a blast of tri-tone followed by Alisson saying "Weasels
have eaten our phone system", I suppose recording their reactions to
that might be mildly interesting ...

On 07/11/2011 09:21, Koos van den Hout wrote:
> Rob van der Putten<rob@sput.nl> wrote in<4ea73720$0$1307$e4fe514c@dreader23.news.xs4all. nl>:
>
>> A bit of Analog style log processing;
>> http://www.sput.nl/asterisk/#req
>> Of you strip leading stuff like '00' and '011', you end up with numbers
>> like 442035199055 and 442035199098.
>
> I had a look at the attempts I logged on an asterisk server and while I did
> notice the attempts to reach UK numbers in a likewise pattern I can't find
> any attempts to reach the exact same numbers.
>
> Either there are a lot of attackers trying this or they select a UK number,
> give it a few tries and drop it immediately.
>
> For added fun I answer those calls, play a random 'this number is not in
> service' recording from somewhere around the world .. and I record the
> incoming and outgoing audio. Sofar this got me a recording of a lot of
> noise: http://idefix.net/~koos/newsitem.cgi/1311000729
>
> Koos
>
It occurred to me some time ago how that would be a good tactic for
insurance company's and the like to use.
While the would be claimant is waiting for the call to be answered,
(ringing tone rather than music-on-hold might work best), the call is
recorded and reviewed later for evidence of fabricating a false story.


--

Graham.

%Profound_observation%

On 07/11/2011 10:38, Andy Burns wrote:
> Koos van den Hout wrote:
>
>> Either there are a lot of attackers trying this or they select a UK
>> number,
>> give it a few tries and drop it immediately.
>>
>> For added fun I answer those calls, play a random 'this number is not in
>> service' recording from somewhere around the world .. and I record the
>> incoming and outgoing audio. Sofar this got me a recording of a lot of
>> noise: http://idefix.net/~koos/newsitem.cgi/1311000729
>
> I just play them a blast of tri-tone followed by Alisson saying "Weasels
> have eaten our phone system", I suppose recording their reactions to
> that might be mildly interesting ...

You are all welcome to use the famous "Grampa Stack" recording I have
put here.
telecrapper@sip2sip.info


--

Graham.

%Profound_observation%