The desktop of a phone SIP scammer.

For some very strange reason my own portal for remote support is named “Asterisk Management Portal”. This title is the name of an out-of-box flash and php based management portal for the Asterisk SIP / IAX VoIP system.

This has the side effect that I see incoming traffic for exploiters or SIP VoIP fraudsters searching for exploitable Asterisk Management Portal setups. Even though my page has no VoIP services linked on it, hosted on the IP or relating to it.

This morning it seems that an Arabic VoIP scammer must have stumbled across my site but also gone as far as running my VNC based remote support application.

Helpfully he has given me a screenshot / snapshot of his desktop. I thought it might be interesting to post here to aid anyone else searching or researching how SIP fraud works.

phone sip scammer screen shot

From the screenshot (click it to enlarge it) it seems that.

-They have multiple tabs open with what appears to be a search for Asterisk Management Portals, something to do with Polycom and FreeSwitch.
-They are using Shodan Search which is a page for searching more in-depth than Google. This was recently used by a security researcher to discover that MacKeeper had exposed all their customer database to the internet!
-They also have 10 copies of what I believe is a SIP / VoIP application open along the bottom of their screen. I am going to surmise that each one of these must be connected to a compromised SIP system and will be used or is being used for making calls to premium rate numbers.
-They also have several bookmarks for searches at Shodan to do with Polycom, Omegadial and Aastra.
-They use Avast antivirus, currently broken or disabled.
-They are on a laptop that isn’t currently connected to the power.

It seems that the scammer who ran the remote support tool has the name “Raednahal” and had a Skype conversation or call open with someone called “Ahmed S”.

One of their bookmarks is for callstats.biz which appears to be some sort of premium rate number list where you can sign up, make calls to it and get paid:

a lot of good access
no rules
no limit
on time payment!!

Work watch premium numbers and sites,
https://www.callstats.biz/
skype: supoort.wood

Live Statistics
Fast Payment
24/7 Support
User Panel
Bank Wire
MoneyGram

It seems that most of the UK numbers listed on the site charge the caller around 40 pence per minute (£0.40). Some are as high as 54 pence per minute. This revenue is then likely shared with the people who run callstats.biz who then further pass a share onto the original VoIP scammer.

None of the numbers I tested calling accepted calls.

At some point “sarah.webb933” was also a skype name associated with the payout “company”. Somehow also related is “call2you.eu”.

Quite interesting seeing how well catered the VoIP scam world is with intermediate revenue sharing companies etc.

Advertisements
This entry was posted in Uncategorized. Bookmark the permalink.

4 Responses to The desktop of a phone SIP scammer.

  1. Gab says:

    a lot of good access
    no rules
    no limit
    on time payment!!

    Work watch premium numbers and sites,
    https://www.callstats.biz/
    skype: supoort.wood

    Live Statistics
    Fast Payment
    24/7 Support
    User Panel
    Bank Wire
    MoneyGram

    Have you check this? are this legit? and really pays? thank you

  2. Previous comment from gabriellydiasferreira2016@gmail.com / 112.198.64.8

    How about getting a real job rather than scamming?

  3. Gab says:

    Im sorry this site was recommeded by my friend and i dont know how really it works..

    what can you say about callstats.biz?

    Some of my friends are getting paid using that site.

    Is the support of callstats are scammers? skype: supoort.wood

    Please advice thank you

  4. dhan says:

    im not paid now callstats are scammers

Comment on this topic

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s