A VoIP Toll-Fraud Probe on My Honeypot
My honeypot’s SentryPeer sensor and Suricata picked up a burst of SIP INVITE requests from one rented VPS, each trying to place a call to a premium-rate international number. This is toll-fraud reconnaissance: hunting for a phone system that will place expensive calls billed to its owner.
Triage summary
Malicious- Disposition
- Malicious: toll-fraud reconnaissance
- Detected by
- SentryPeer sensor and Suricata
- Source
- 208.109.190.200 (GoDaddy VPS, AS398101)
- Target
- UDP/5060 (SIP)
- Action taken
- Source IP reported to AbuseIPDB
Evidence
- ▸SIP INVITE requests over UDP/5060 from 208.109.190.200, arriving from rotating source ports (50352, 52392, 56775), consistent with a scripted dialer opening a new session per attempt.
- ▸A User-Agent of "Cisco-SIPGateway." A GoDaddy VPS is not a Cisco gateway, so the string is there to make the traffic look like carrier equipment.
- ▸Destination numbers stepping through sequential international ranges on premium-rate prefixes.
- ▸Full SDP negotiation in the requests, meaning it was trying to complete real calls, not just map the service.
Assessment
Toll fraud bills the victim, not the attacker. A misconfigured PBX that accepts these calls can run up a large charge before anyone notices, and the carrier usually holds the account owner responsible. Disposable rented infrastructure and a legitimate-looking vendor string cost the attacker nothing and get past simple IP blocklists and fingerprint filters.
What I would alert on
- ▸One source sending INVITEs to many different destination numbers in a short window.
- ▸Call attempts to premium-rate and high-cost international prefixes.
- ▸A User-Agent claiming carrier hardware from hosting-provider address space.
Recommendations
Keep SIP off the open internet, require authentication on every trunk and extension, and cap outbound calls by destination and concurrency so a compromised PBX cannot run up a bill overnight.