4 ms·
I wonder if the author had considered more closely replicating a 'real call'? Most of the fraudsters use automated dialers that anticipate the 200OK as a succes
by telebone_man 10y ago
I wonder if the author had considered more closely replicating a 'real call'? Most of the fraudsters use automated dialers that anticipate the 200OK as a successful call ... etc.
I did something like that, and was surprised to learn both the lack of media, and predictable media (white noise, or a particular pre-recording) were themselves indicative of 'artificial traffic' (and therefore, likely fraud).
- trome 10y agoYeah, often fraudsters using Sipvicious won't complete the call and connect to media, I've seen this when routing all unauthorized traffic to 800 numbers.
- nirsimionovich 10y agoActually, the honeypot system is slightly smarter than that. Some of the honeypots are actually based up a SIPP UAS scenario, which will accept any traffic and will play back an audio file of 5 minutes. Those servers normally yield slightly different results, that normally look like a scan, then followed by a media test then followed by something that looks almost manual - and after the manual test, they go away, after realizing they hit a honey pot.