Our operators reported yesterday that our main number was hit with a barrage of calls, all from the same number. All the lines on all of their phones lit up and were ringing and every one of them was the same thing - silence. This is backed up by the call recordings - it’s them answering the call as if it were a customer, waiting a few seconds, and hanging up when there was no response. I looked up the call & found it’s a Verizon cell phone, which I found strange. Call logs show 13 calls in one minute, some only a couple seconds apart; I didn’t know that cell phones were capable of dialing that fast. Our operator called the number and it was indeed a customer who wanted service, so I’ve no clue what happened.
I asked our trunk provider about it and their technician said that they were probably scam calls, regardless of it being a cell number or the person picking up when called back. When I asked about call storm remediation for something like this - basically, allow n calls from the same number in x seconds - he said that it’s not something they can do with their tools. They just provide the SIP trunk and pass calls to our system & that something like that would have to be done at the PBX level.
This has happened a few times in the past, but *extremely* infrequently. (Once a year maybe???) I’d like to prevent it from happening again if it’s something that can be accomplished with relative ease, but I’ve never heard of a feature to accomplish this in FreePBX. (We’re stuck on version 13.) Does anyone know if such a feature exists & if so, where I might find it?
I am fairly certain this is an originator / upstream issue, not a problem with your setup or the SIP provider, and NOT scammers or spammers. We had the exact same thing happen to us a couple of weeks ago with 3 of our client sites. It was the same day that verizon reported their outage. One of our clients runs an national hotline to answer calls. Normally they get about 25 calls a day. On this particular day, every inbound call generated upward of 19+ “copies” of the call, all with dead air when answered, all with the same time stamp or within a few seconds of each other. In a matter of 2 hours of people trying to call in, we had recorded over 400 copy calls, By the end of the day we had over 600 calls, and when you look at the inbound numbers, it was all from about 25 phone numbers. A few hours later it “resolved” itself after verizon get their head on straight.
The OP wants to know how to have the system do this automatically, and rapidly, potentially within seconds, even in the middle of the night. I think he also wants to have the block automatically remove itself.
Also, I suspect they want rate limiting, rather than a complete block.
Exactly right. I did find an old topic with information on how to accomplish this, but it involves editing the asterisk config files directly. The person on that thread was having difficulties, so my chances of getting it working properly without nuking the system are slim.
This is very very interesting. I never thought that it might be caused by something on the far end, nor that it was happening to other people. Thank you so much for responding and letting me know; going to tell our trunk provider about this on Monday & see what they have to say.
At this point, I do not believe that the effort required and risk involved with implementing something to mitigate such an infrequent problem is warranted. I can count the number of times these ‘call storms’ have happened since I migrated us away from CCM back in 2019 on my fingers. (Both real spammers & these phantom copies of real calls.)
Yep, That is basically what I was leaning towards too. I was really intent to stop this “threat” for a few hours and then when I realized there was national comm’s thing happening, I had to wonder how many hours I would put into a fix for something that never happened to us before that I am aware of, and may not happen again for quite some time.
