Wangiri & International Revenue-Share Fraud

IRSF and Wangiri types of fraud are generating huge losses for consumers and network operators alike. These types of fraud are not particularly sophisticated or complicated to carry out.

About 13 years ago, a good friend of mine, who was the head of anti-organised crime in the area where I live, contacted me. His organisation also fought against internet crime and cooperated strongly with other states, sharing information to catch bad actors. One day, he called me and asked if I could help one of his prosecutors understand and explain to a judge how someone had made about 5 million USD from a fraud they had not encountered before. They had intercepted many messages, IP packets, and computer logs, and had followed a money trail. As everything was on paper, it took me a while to understand and explain it.

The fraudster was very organised and operated this fraud for about a year or so. I will briefly explain what he did:

He exploited a zero-day vulnerability in the Asterisk PBX and began scanning hosts for this vulnerability. Once a host was found, he hacked it, installed a rootkit, and an IRC bot that would connect to his IRC channel to receive commands. Each hacked machine would then start scanning for other hosts with the same vulnerability, behaving like a worm and operating autonomously, all with automated scripts. The fraudster would then check his IRC channel to see how many machines he could fully control.

He visited one of the thousands of websites that advertise the sale of IPRN (International Premium Rate Numbers) and obtained some test numbers from there. I will explain later how these work.

He then issued a command on his IRC channel for all his hacked machines to call the test numbers and see if they connected to the IPRN provider. Those who successfully connected to the IPRN provider were added to a group. He reserved numbers from those ranges and issued commands to the IRC bots so that the hacked machines would call those numbers (he cleverly parameterised the scripts—such as how many calls to make in parallel, how long the calls should last, etc.).

By being paid by the IPRN provider, he made around 5 million USD, and he was eventually caught because of the money trail.

IPRN numbers are either real numbers or even fake ones that are advertised by IPRN providers to voice transit carriers as belonging to them. In an ideal world, any transit carrier would accept such numbers as being lawfully allocated to the IPRN provider, although this doesn’t always happen.

If you make a call from your phone to one of these IPRN numbers, and if, along the call path, there is a transit carrier that has an agreement with the IPRN provider, the call is routed to you or to an IVR, and the IPRN provider will pay you a portion of the international termination rate. This is generally long-distance as operators have local and regional interconnects that won’t go through those transit carriers.

IRSF vs Wangiri

The technique I described earlier was IRSF. Wangiri works in a very similar way, but you don’t have to hack any machines. Here’s what you would do:

1. Find out call paths that would reach the IPRN provider (e.g. you know that IPRN numbers in Somalia reach the IPRN provider when called from T-Mobile US).
2. Reserve such numbers and create an interesting IVR that would encourage people to stay on the phone.
3. Make flash calls to as many T-Mobile US numbers as possible by spoofing the A-number (CLI) to look like the IPRN numbers.

Then, it’s a numbers game. X number of users would see missed calls from that Somali number, Y% of them would call back, and they would have an average call duration of Z minutes. The IPRN provider will then pay your share of the termination call to Somalia for X * Y% * Z minutes. If you adjust the variables, you can make a significant amount of money.

Hands-on Example

I logged in to an IPRN provider, obtained a Denmark number (anonymised below) that was live, and called it—it rang until I reached a voicemail (a standard one). Below is the number (anonymised) along with our live service response. To note, before that, I called another IPRN Denmark number where a regular person answered

I checked the latest test calls on the IPRN site and couldn’t find my call—which means the calls I made did not reach the IPRN provider, as they didn’t go through any of the transit carriers that have an agreement with this provider.

So, this is an advertised IPRN number, but I’m charged a normal rate.

• The IPRN provider should have interconnects with transit carriers to get those numbers routed to them. It is generally not dynamic pricing but standard pricing.
• When a call from Chile (especially if you use a landline VoIP service, etc.) originates to this Denmark number, it is very likely that the call will pass through multiple transit carriers.
• If one of the carriers has an agreement with the IPRN provider, the call is routed to that provider, and an IVR is played. Generally, this should be something catchy to encourage you to stay on the phone for a long time.
• Depending on the pricing the customer has, they will pay the fee for being on the call to a Denmark mobile (generally not extra/premium).

Ways of Making Money from This Service

1. Hacking vulnerable IP PBXs (such as outdated Asterisk boxes). In this case, you would initiate test calls to IPRN test numbers from IPRN providers to see if the calls reached them. If they did, it means calls to that destination go through a transit carrier with which the IPRN provider has a contract. You would then reserve your IPRN from that particular range and make as many calls as possible. This way, the owner of the hacked PBX ends up with a huge phone bill, even though the calls didn’t go anywhere (just to the IPRN provider’s IVR). The transit carrier charges the network of the hacked PBX and splits the money with the IPRN provider, who will pay you (the hacker) 50/50 or whatever the agreed percentage is.
2. Wangiri – this works as follows:
   • Use some form of testing towards all premium numbers from as many networks as possible. Alternatively, and more easily, you could see test calls on the IPRN provider website (with the call date and actual IPRN number removed, which shows under the DID column).
     
   • For example, let’s consider calls to Tajikistan, which are made from Russian Tele2 numbers. You would know that subscribers calling from Russia Tele2 to Tajikistan Mobile Beeline will go through a transit carrier that has an agreement with this IPRN provider.
   • You get an IPRN from this IPRN provider to Tajikistan Mobile Beeline, create a nice IVR in Russian to keep people on the line.
   • You obtain a SIP service and start generating calls (such as flash calls) that you cancel immediately after the ring indication to random Russian Tele2 numbers, using the CLI of the number you obtained from the IPRN provider.
   • Out of tens of thousands of “missed calls”, some of the recipients will call back, and some will stay on the line longer or not. You are paid by that particular IPRN provider approximately $0.03/minute.

   A simple example: you make 100,000 flash calls, 20% of the recipients call back and spend an average of 2 minutes on the line. You make $1,200 – but the people calling would probably pay ~ $0.5/minute, so the overall fraud amounts to $20,000.

How TMT Can Help

We work with a few companies that scrape as many IPRN provider sites as possible and create a database of those numbers. At the time of writing this post, the current number of entries in the IPRN table is 20,073,001, of which 13,518,172 (67%) are valid numbers.

This database can be purchased as a download or queried through our Teleshield Fraud Service.

The data can be used to identify and block calls in response to flash calls from IPRN numbers, shorten call durations, limit the number of calls to IPRN numbers, and more.