[AusNOG] Scam Number 0343444621

Sat Jan 25 20:20:36 EST 2020

We route based on CLID to a queue that plays music for 5 minutes then 
plays. "You are now 975'th in the queue please hold" and the goes back 
to music. A recording is made of the snippet where it says how far they 
are in the queue and is emailed to the helpdesk for comedic value.

Matt

On 25/1/20 12:03 pm, Matthew Moyle-Croft wrote:
> Faxes, when they answer a call are silent until they hear the tone from the calling fax.
> A lot of the software that drives outbound calls will listen for silence on the far end so they don’t connect a human to a fax machine and waste time on their outbound call centre.
>
> If you get a call from a number you don’t recognise, be silent when you answer. Mute if possible. A lot of the time your number will be marked as a fax machine and they’ll stop calling.
>
> So, rather than have no answer as per below, route it to something that answers (costs them money to complete the call) and is silent to pretend to be a fax machine.
>
> MMC
>
>> On 21 Jan 2020, at 10:20 pm, Saxton, Joseph (SYD-FED) <Joseph.Saxton at interpublic.com> wrote:
>>
>> Not sure how your PBX is setup, but in the environments I've worked with I've avoided using default call routing on unallocated DID numbers back to the main number. I've found that a fair few of the scam callers dial through the full DID range. Doesn't stop the calls but can somewhat reduce the calls from them.
>>
>> -Joe
>>
>> On 21/1/20, 7:00 pm, "AusNOG on behalf of James Andrewartha" <ausnog-bounces at lists.ausnog.net on behalf of trs80 at ucc.gu.uwa.edu.au> wrote:
>>
>>     The Spam Act doesn't cover phone calls, s5 (5) excludes them. Blocking is
>>     also pointless since all the caller IDs are spoofed differently per call.
>>     Some of them are clearly invalid, I have examples like 07 6539 5789 and
>>     08 0804 4878 which are not assigned in the numbering plan
>>     https://urldefense.proofpoint.com/v2/url?u=https-3A__www.legislation.gov.au_Details_F2016C00283&d=dffDwIDaQ&c=Ftw_YSVcGmqQBvrGwAZugGylNRkk-uER0-5bY94tjsc&r=srheiojgNn4Jg0keeQ9hj6cyp8zgHx0m-eTRLdD3nnw&m=LwnNSmlgVzMX0qfT0FCeF8k-bFt_hBCeu9CfrHaZYx4&s=ql5IaZ4JO98B72cExoAoUF4U8ebk0zWRxgyU5vn56GA&e=
>>
>>     --
>>     # TRS-80              trs80(a)ucc.gu.uwa.edu.au #/ "Otherwise Bub here will do \
>>     # UCC Wheel Member     https://urldefense.proofpoint.com/v2/url?u=http-3A__trs80.ucc.asn.au_&d=DwIDaQ&c=Ftw_YSVcGmqQBvrGwAZugGylNRkk-uER0-5bY94tjsc&r=srheiojgNn4Jg0keeQ9hj6cyp8zgHx0m-eTRLdD3nnw&m=LwnNSmlgVzMX0qfT0FCeF8k-bFt_hBCeu9CfrHaZYx4&s=GyPeNnpGViNogqVS2NFym2NkN7rmauKXYjxvk9lKCcg&e=  #|  what squirrels do best     |
>>     [ "There's nobody getting rich writing          ]|  -- Collect and hide your   |
>>     [  software that I know of" -- Bill Gates, 1980 ]\  nuts." -- Acid Reflux #231 /
>>
>>     On Tue, 21 Jan 2020, Mark Newton wrote:
>>
>>> Doesn’t the subscriber handle it by complaining to ACMA? The Spam Act has to be worth something, right?
>>> (if you block the number somewhere else, you’re just going to create a headache for the next person who receives it after the
>>> scammer has moved on. It needs to be dealt with at the source, and that’s not exactly something you can do…)
>>>
>>> - mark
>>>
>>>
>>>
>>>       On 21 Jan 2020, at 1:46 PM, James Andrewartha <trs80 at ucc.gu.uwa.edu.au> wrote:
>>>
>>> What's the best way to handle these? In November we got a lot of calls
>>> with random caller IDs, and I was gathering logs to open a case with our
>>> carrier per the Comms Alliance CUSTOMER PROCESS –HANDLING OF LIFE
>>> THREATENING AND UNWELCOME COMMUNICATIONS but by the time I was ready to,
>>> they'd stopped.
>>>
>>> Obviously that process is fairly weak sauce, particularly if you read the
>>> actual code which allows for no action if the supplier is unable to
>>> identify the source of the communication, but I was at a loss to find any
>>> other process to try and stop the calls.
>>>
>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.commsalliance.com.au_-5F-5Fdata_assets_pdf-5Ffile_0004_56227_IGN010-5F2017.pdf&d=DwIDaQ&c=Ftw_YSVcGmqQBvrGwAZugGylNRkk-uER0-5bY94tjsc&r=srheiojgNn4Jg0keeQ9hj6cyp8zgHx0m-eTRLdD3nnw&m=LwnNSmlgVzMX0qfT0FCeF8k-bFt_hBCeu9CfrHaZYx4&s=pWlePaeKZg8iidKrAzSWojXCLq1dNcW6jbIuMjOPcsc&e=
>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.commsalliance.com.au_-5F-5Fdata_assets_pdf-5Ffile_0006_60549_C525-5F2017-2Dvariation-2D1-5F2018.pdf&d=DwIDaQ&c=Ftw_YSVcGmqQBvrGwAZugGylNRkk-uER0-5bY94tjsc&r=srheiojgNn4Jg0keeQ9hj6cyp8zgHx0m-eTRLdD3nnw&m=LwnNSmlgVzMX0qfT0FCeF8k-bFt_hBCeu9CfrHaZYx4&s=ojrF_jIKplq5zOpebLlbKHonU--g6CIz2saQUzMuXIk&e=
>>>
>>> --
>>> # TRS-80              trs80(a)ucc.gu.uwa.edu.au #/ "Otherwise Bub here will do \
>>> # UCC Wheel Member     https://urldefense.proofpoint.com/v2/url?u=http-3A__trs80.ucc.asn.au_&d=DwIDaQ&c=Ftw_YSVcGmqQBvrGwAZugGylNRkk-uER0-5bY94tjsc&r=srheiojgNn4Jg0keeQ9hj6cyp8zgHx0m-eTRLdD3nnw&m=LwnNSmlgVzMX0qfT0FCeF8k-bFt_hBCeu9CfrHaZYx4&s=GyPeNnpGViNogqVS2NFym2NkN7rmauKXYjxvk9lKCcg&e=  #|  what squirrels do best     |
>>> [ "There's nobody getting rich writing          ]|  -- Collect and hide your   |
>>> [  software that I know of" -- Bill Gates, 1980 ]\  nuts." -- Acid Reflux #231 /
>>>
>>> On Fri, 17 Jan 2020, Bradley Amm wrote:
>>>
>>>       A lot come from Symbio but yes it’s probably just spoofed.
>>>
>>>       Quite easy to spoof a caller ID
>>>
>>> _______________________________________________________________________________________________________________________________
>>>       _
>>>       From: AusNOG <ausnog-bounces at lists.ausnog.net> on behalf of Jennifer Sims <jenn at jenn.id.au>
>>>       Sent: Friday, January 17, 2020 8:15 am
>>>       To: Brent Paddon
>>>       Cc: ausnog at ausnog.net
>>>       Subject: Re: [AusNOG] Scam Number 0343444621
>>>       It also doesn’t mean it’s not an over stamped or spoofed either
>>>
>>>       Sent from my iPhone
>>>
>>>            On 17 Jan 2020, at 10:12, Brent Paddon <brent.paddon at gmail.com> wrote:
>>>
>>>            Symbio (MNF) host it.  Doesn't mean outbound is going that direction, but they're still hosting it.
>>>       Brent
>>>
>>>       On Thu, Jan 16, 2020 at 4:17 PM Matthew Matters <mmatters at ausnetservers.net.au> wrote:
>>>       Afternoon Noggers,
>>>
>>>       Can every provider check their records to see if they are hosting 0343444621.
>>>
>>>       This number is being used to scam / spam and the number should be terminated as soon as possible
>>
>>
>> This message contains information which may be confidential and privileged. Unless you are the intended recipient (or authorized to receive this message for the intended recipient), you may not use, copy, disseminate or disclose to anyone the message or any information contained in the message.  If you have received the message in error, please advise the sender by reply e-mail, and delete the message.  Thank you very much.
>> _______________________________________________
>> AusNOG mailing list
>> AusNOG at lists.ausnog.net
>> http://lists.ausnog.net/mailman/listinfo/ausnog
> _______________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog

-- 
/* Matt Perkins
         Direct 02 8916 8101     Spectrum Networks Ptd. Ltd.
         Office 1300 133 299     matt at spectrum.com.au
         ABN 66 090 112 913      Level 6, 350 George Street Sydney 2000
*/