Citigroup, Idaho, and Build-a-Bear Launched a Coordinated Attack on Me
knock-knock.net3 points by djkurlander 19 minutes ago
3 points by djkurlander 19 minutes ago
Author here (I run the honeypot).
Since "coordinated attack" will raise eyebrows: the named organizations didn't coordinate anything, but malware running on their networks did. Each organization has a compromised device somewhere on its network, a laptop or a VoIP phone or an appliance, that got recruited into a botnet. The coordination is the botnet's command-and-control (C2). Dozens of these machines, across unrelated networks, hit the same target phone number inside the same 27-hour window and spoofed the same small set of fake caller IDs. Independent infections don't pick the same disguises and target by chance.
The part I found most interesting: the operator deliberately routes through institutional IP space (a defense contractor, banks, two US state governments, a police force) precisely because those ranges have clean reputations. Datacenter and VPS IPs get fraud-scored to death; nobody blocklists Lockheed Martin's netblock. A compromised box inside a trusted network is worth more to them than a rented VPS.
Something else I keep wondering about: a foothold inside Citigroup or Lockheed is a goldmine, yet here it is being spent hunting for SIP relays. International Revenue Share Fraud is lucrative, but it feels like a modest use of that access. The SIP scanning may just be the part I can see from outside; the same malware could easily be after the data on those networks too.
The honeypot presents as an open SIP relay but answers the calls locally, so it logs what the attackers were trying to do without being the vulnerable PBX they were hoping to find. It has recorded ~11.5M protocol attempts across many protocols, not just SIP.
I also put the data behind a free, no-key API so anyone can check their own space:
curl 'https://api.knock-knock.net/check-asn?asn=<your ASN>'
Check out the honeypot dashboard at https://knock-knock.net. Blocklists, since folks always ask: https://knock-knock.net/blocklist
Would appreciate any questions or suggestions. Thanks!