Hi Aaron,
Is that a Twilio "Voice Trace" pcap you can download ? I thought
those were for Twilio support engineer / internal viewing only. Or are
the ones you mention called something else ?
-Jeff
Quoting "Aaron C. de Bruyn via VoiceOps" <[email protected]>:
I forgot Twilio lets you download PCAPs of calls.
I grabbed one at random:
P-Asserted-Identity: <sip:[email protected]:5060[1]>
SIP PAI Address: sip:[email protected]:5060[1]
SIP PAI User Part: +14632018300
E.164 number (MSISDN): 14632018300
SIP PAI Host Part: 206.147.72.38
SIP PAI Host Port: 5060
-A
On Wed, Mar 18, 2026 at 8:44 AM Aaron C. de Bruyn
<[email protected]> wrote:
I did NOT know that. :) I'm not a telco or service
provider. Just part of a company that's unfortunate enough to help
a handful of customers manage their own internal Asterisk or
FreePBX systems.
Most of my customers use Twilio upstream. I don't think
Twilio logs that header, and I don't see anything like it in the
Asterisk logs. (Not sure if it even gets passed to us or if it
just doesn't logs it.)
-A
On Wed, Mar 18, 2026 at 8:36 AM Mark R Lindsey
<[email protected]> wrote:
So...did you get any Identity headers? A traceback with ITG, or
maybe an Identity header, is your only hope for tracing the
origin.
I'm including the below, not to say that you, Aaron, don't
know this, but just in case it's valuable to anyone else reading:
In the case of your first number, it belongs to a thousand
block assigned initially to Bandwidth.com[2]...but that's not even
meaningful for routing a call to them today. You'd have to do an
LRN lookup to find out how to deliver a call back to the
legitimate owner of this number.
I did an LRN lookup for that first one, and it's currently
ported to Onvoy, one of the brands of Sinch. But again, that only
tells us how to get a call TO that legitimate owner.
What you want to know is how they're sending calls to you.
And if you're getting an Identity header it would be at least
interesting.
Failing that, you can file a report with the Industry
Traceback Group to report illegal calls:
https://tracebacks.org/traceback-requests/
MARK R LINDSEY | +1-229-316-0013 | [email protected] | LINKEDIN[3]
On Mar 18, 2026, at 11:22, Aaron C. de Bruyn via VoiceOps
<[email protected]> wrote:
A bunch of numbers out of
Indiana have been spamming my customers for about a week.
Most are automated recordings about how your Google
business listing is wrong and needs to be fixed so customers can
find you. Sometimes it's a human prefixed by the telltale
"BWOOP" sound.
+14632000068 - BANDWIDTH.COM[4] CLEC LLC IN
+14632001925 - BANDWIDTH.COM[4] CLEC LLC IN
+14632004002 - BANDWIDTH.COM[4] CLEC LLC IN
+14632005772 - BANDWIDTH.COM[4] CLEC LLC IN
+14632006038 - BANDWIDTH.COM[4] CLEC LLC IN
+14632006422 - BANDWIDTH.COM[4] CLEC LLC IN
+14632006730 - BANDWIDTH.COM[4] CLEC LLC IN
+14632009587 - BANDWIDTH.COM[4] CLEC LLC IN
+14632018300 - BHN IP ENABLED SERVICES LLC
+14632018413 - BHN IP ENABLED SERVICES LLC
+14632018586 - BHN IP ENABLED SERVICES LLC
+14632018682 - BHN IP ENABLED SERVICES LLC
+14632027042 - LEVEL 3 COMMUNICATIONS LLC IN (Lumen)
+14632027073 - LEVEL 3 COMMUNICATIONS LLC IN (Lumen)
+14632027200 - LEVEL 3 COMMUNICATIONS LLC IN (Lumen)
+14632027252 - LEVEL 3 COMMUNICATIONS LLC IN (Lumen)
+14632027397 - LEVEL 3 COMMUNICATIONS LLC IN (Lumen)
+14632027539 - LEVEL 3 COMMUNICATIONS LLC IN (Lumen)
+14632027678 - LEVEL 3 COMMUNICATIONS LLC IN (Lumen)
+14632027899 -LEVEL 3 COMMUNICATIONS LLC IN (Lumen)
+14632030946 - METROPCS INC (T-Mobile US)
Kinda hard to believe the big boys haven't caught
this abuse of their network yet.
I tried reporting the numbers to bandwidth.com[4]
(as ID'd by telcodata.us[5]), but their form only allows for a
single entry at a time, and it says most of the numbers don't
belong to them. Either their form is broken or telcodata.us[5]
is out of date.
I can't find a reporting for Level3/Lumen. They
seem to be geared towards "I'm a customer and need help figuring
out the star code to block calls".
-A
_______________________________________________
VoiceOps mailing list -- [email protected]
https://lists.voiceops.org/postorius/lists/voiceops.voiceops.org/
To unsubscribe send an email to [email protected]
Links:
------
[1] http://sip:[email protected]:5060
[2] http://Bandwidth.com
[3] https://www.linkedin.com/in/markrlindsey/
[4] http://bandwidth.com/
[5] http://telcodata.us/
_______________________________________________
VoiceOps mailing list -- [email protected]
https://lists.voiceops.org/postorius/lists/voiceops.voiceops.org/
To unsubscribe send an email to [email protected]
