The honeypot that gets robbed: a fifth of all honeypot traffic is toll fraud, not intrusion

§ 01. The attacker who wants your dial tone

Report 001 argued that most of what a honeypot sees is knocking, not exploitation. Report 002 showed the knocking is a dozen separate credential campaigns, each carrying a dictionary shaped like the device it expects. Both are about access – getting through the door.

There is a class of attacker on our sensors that never wants through the door. He wants the phone on the desk behind it. One of the busiest services on the whole fleet is SIP, the signalling protocol behind VoIP, presented as an ordinary internet-facing Asterisk PBX. Across a 24-day continuous capture the fleet logged 23.7 million events, and SIP drew 5.24 million of them – 22%, a fifth of everything, running ahead of SSH. When we re-sampled the live sensors two months later, in August, SIP was still one of the busiest services and the same numbers were still on the wire. And the technique those events map to is not "brute-force access" or "exploit"; it is MITRE ATT&CK T1657, Financial Theft. The attacker's objective is to register one extension on our PBX and use it to place a flood of international calls to numbers that pay him a cut of the per-minute charge – charges that land on the PBX owner's bill. It is the one attack in this dataset where the goal is money, and the loss is counted in call minutes.

§ 02. Two knocks and a phone call

The traffic splits into two phases, and they are usually not the same machine – it reads as a botnet division of labour, one set of hosts mapping the PBX, another placing the calls.

Phase one is extension enumeration. A working PBX answers a request to a valid extension with a 401 authentication challenge and a non-existent one with a 404; iterate through extension numbers, keep the ones that return 401, and you have mapped the dial-plan before guessing a single password. Attackers spray defaults and short ranges first – 100, 1000, 10000 and round numbers are common default numbering conventions – then brute-force the SIP Digest password of the extensions that answer. The requests arrive as endless REGISTERs, one extension at a time, and the user-agent frequently names the tool outright:

REGISTER sip:<sensor> SIP/2.0
Via: SIP/2.0/UDP 217.160.124.58:61334;branch=z9hG4bK794120311
From: <sip:8242@<sensor>>;tag=2001915645
To: <sip:8242@<sensor>>
CSeq: 6 REGISTER
Contact: <sip:[email protected]:61334>
Authorization: Digest <redacted>
User-Agent: pplsip

Phase two is the actual fraud: an INVITE that asks the PBX to dial an outside number. This is where the money is, and it is where the attacker gets sloppy in interesting ways:

INVITE sip:250000000018303567168@<sensor>:5060 SIP/2.0
Via: SIP/2.0/UDP 149.50.107.48:49436;branch=z9hG4bK-a3217b1e15584417ab0a579b9f88f634;rport
Max-Forwards: 70
From: <sip:[email protected]:49436>;tag=db0e36fd3a0f
To: <sip:250000000018303567168@<sensor>:5060>
Call-ID: [email protected]
CSeq: 14022180 INVITE
Contact: <sip:[email protected]:49436>
User-Agent: VOIP

§ 03. The dialled numbers

The To field on those INVITEs is the receipt, and it does not look like random dialling. In the live August sample the fleet saw 2,801 INVITEs resolving to just 422 distinct destination numbers – a small, fixed set, dialled over and over. The striking part is the continuity: the single most-dialled number, 2164094000, is the same one that led this table back in June. Two months on, the identical target is still being fuzzed. And each number is dialled not once but in a battery of variants:

This is the tell that separates toll fraud from ordinary scanning: the goal is not to reach a specific person, it is to find any prefix that yields an outbound line. The numbers span the map – a Tunisian form dialled thousands of times, a Liverpool landline, a Moscow line. One cluster sits closer to home: a run of destinations behind 0037…, dialling straight into the Baltic country codes – +371 Latvia, +370 Lithuania, +372 Estonia. These look like "premium-rate numbers." They almost certainly are not. Real toll fraud abuses ordinary, validly-allocated numbers that have been quietly signed up as revenue generators; the one genuine international premium-rate prefix reserved worldwide is ITU's +979, and fraud almost never touches it. What we are watching is the earlier, cheaper step the honeypot literature calls "proving you can call out" – the attacker tests low-cost, local-looking numbers first, confirms our PBX will place a call, and only then would switch to the expensive destinations that actually pay.

§ 04. How a phone call becomes money

The economics are what make this worth industrialising. International Revenue Share Fraud runs on a three-party chain. A provider of "International Premium Rate Numbers" advertises ordinary phone numbers as revenue generators. A fraudster acquires those numbers and generates traffic to them – ideally through someone else's hacked PBX. And a complicit transit carrier "short-stops" the call, quietly terminating it into the revenue-share provider instead of the real destination, then splits the take. The victim is billed the full international per-minute rate; every hop keeps a slice; the fraudster collects his share. Because international routing is opaque and inter-carrier deals are confidential, working out who profited is close to impossible.

The per-minute cut can be almost nothing – fractions of a cent in some countries. The money is entirely in volume: many calls, placed in parallel, run overnight and over weekends when no one is watching the billing. The supply side is a genuine market – one academic crawl catalogued 3.14 million distinct "test" numbers across 238 countries from a dozen provider websites, complete with live dashboards and payouts in Bitcoin, PayPal or Western Union. This is a settled economy, with account managers and dashboards, and our PBX is free inbound traffic for it.

§ 05. The bill

The reason attackers find an exposed PBX in minutes is that the reward is disproportionate to the effort. The CFCA, the telecom industry's anti-fraud body, put total telecom fraud near $38.95 billion for 2023; the IRSF share alone was put at roughly $6.1 billion in the 2017 CFCA survey researchers lean on – about a fifth of that year's telecom fraud. Those are macro numbers; the per-victim ones are worse:

• A small US architecture firm was billed roughly $166,000 over a single weekend after its phone system was compromised.
• One documented attack placed 11,000 international calls in 46 hours, running a bill past $120,000.
• The people behind these schemes are not untouchable. A US prosecution over a PBX-hacking operation ended in a guilty plea for laundering $19.6 million; the ring's alleged organiser sits on the FBI's cyber most-wanted list with losses tallied above $70 million.

And the exposure is instant. The FreePBX honeypot that mirrors ours took in about 19 million SIP messages in ten days, 7 million of them on its busiest day, on an IP address it never advertised. You do not have to publish a PBX for the internet to start dialling through it.

§ 06. The mask

The tooling shows how industrialised this is. In the live August sample the single loudest user-agent is a flat, generic VOIP – a label that says nothing – trailed by pjsip python, a hand-rolled script on the PJSIP library. Right behind them comes a parade of real desk-phones: Linksys-SPA942, Polycom SoundPointIP, Cisco-SIPGateway/IOS-12.x. Attackers set the SIP user-agent to a legitimate handset because the naive defence – block the known scanner strings, friendly-scanner and pplsip, with fail2ban – is a game of whack-a-mole the moment the attacker changes one header. Impersonating a Polycom slips straight past it.

Underneath the disguise the tools are ordinary and identifiable. pplsip – still present, now a minority – is Pepelux's sippts. friendly-scanner is SIPVicious, whose brute-forcer walks the Digest challenge until an extension's PIN falls. The pjsip python REGISTERs betray themselves too, carrying PJSIP's signature z9hG4bKPj… branch cookie. None of it is novel. All of it works, because the vulnerability it targets is a config line, not a CVE.

§ 07. The other end of the wire

The Mirage sensor plays a small business's Asterisk box. The same fraud economy runs one layer up, at the carrier and UCaaS platform that business dials through. OffSeq recently disclosed an authorization bypass in 8x8's JaaS SIP gateway: the platform placed outbound SIP calls off a client-supplied entitlement claim instead of the tenant's real provisioning, so a tenant with no paid SIP-outbound feature could drive 8x8's trunk to call an attacker-chosen destination, with a spoofed caller-ID delivered from a trusted @8x8.vc. The commodity botnet fuzzing dial-out prefixes on a decoy PBX and the logic bug that lets a cloud tenant bypass its own calling entitlement are the same crime run at two levels of sophistication.

§ 08. What it means

None of this needs a vulnerability. It needs a phone system that will place a call for a stranger. If you run SIP:

• Reject anonymous calls. Set allowguest=no; an unauthenticated INVITE should never reach a context that can dial a trunk. Isolate the inbound/external context from anything holding an outbound route.
• Kill the enumeration oracle. alwaysauthreject=yes returns an identical challenge for valid and invalid extensions, so the 401-vs-404 map disappears. Give every extension a long, non-default PIN and rename it off 1001/10001.
• Cap the blast radius at the carrier. Set an outbound spend limit and an allow-list of dialable country codes with your provider; block international and premium ranges you never call. A spend cap turns a $100,000 weekend into a $50 one.
• Do not filter on user-agent alone, and do not put 5060 on the public internet. The user-agent is attacker-controlled, and the scanning never stops.

On SIP, "brute force" is not a step toward the breach. It is the breach – and the receipt is a phone bill.

§ 09. About this report

This is the third in a monthly series. Mirage – launched by OffSeq – turns a distributed honeypot fleet into live threat intelligence, filtered down to what is actually being attacked, by whom, and with which payloads, with the background scanning that inflates everyone else's numbers stripped out. The same fleet can be deployed inside your own environment, so the intelligence reflects the campaigns actually aimed at you – including, if you run voice, the ones trying to turn your phone system into their revenue stream.

We publish a new field report every month. Follow OffSeq to get each one as it lands.