International Revenue Share Fraud (IRSF)

I set up servers on the net that masquerade as a SIP relay by essentially supporting the protocol but with few authentication protections. Malware bots scan the IPv4 space looking for such machines that they can use as a relay. My honeypot is actually an extensible framework, and we also can mimic SSH, Telnet, HTTP, SMB, FTP, RDP, SMTP, MQTT, Node-Red, MODB, S7, and SNMP. Individual servers can easily be set up to scan any subset of those. Check out https://knock-knock.net to get a visual sense of what the honeypot is doing!

Good question. You can certainly proxy SIP. But what’s notable here is that the traffic comes directly from organizations that should be secure: banks, infrastructure, governments. For a proxy to explain it, the proxy exit node would have to be running inside those institutions, on their networks. So from a security standpoint it doesn’t really matter whether a botnet is running inside the company or the company is being used as a proxy hop. Either way, a machine on their network has been compromised.

(And your P.S. is spot on. The attacker bears none of the cost; the clean IP reputation and the blame land on the compromised third party.)

Much appreciated! Trying to help out the community with the honeypot & API, and it's always fascinating what attack patterns show up.

Yes - I would have expected better from these institutions as well, but there's always going to be someone who brings their rogue laptop onto the corporate net. The key is how fast the security catches it. They can use the api that I describe in the blog to check my honeypot for their IPs. Very simple to put into a daily or hourly script.

Ha! Love it. Totally believe in it too.

"Coordinated attack" might raise more than eyebrows with the legal departments of the companies you've called out.

>Over the next 27 hours, in four distinct waves, all of them tried to use my VoIP (SIP) server to place phone calls on my dime.

As you've clarified in your comment here the companies did not do this. Compromised machines on their networks, controlled by third parties did it.

No comments, but thank you for sharing and staying vigilant.

A question: why are you writing this with an LLM? Can you not write with your own words, at least on HN?