International Revenue Share Fraud (IRSF)
knock-knock.net
A multinational bank, a US state, and a custom teddy-bear workshop all unwittingly joined the same phone-fraud botnet. Here's how to check whether one of your own machines got caught in the same honeypot.
August 5, 2026
On August 1st, Citigroup, the State of Idaho, and Build-A-Bear launched a coordinated attack on me. They weren't alone. Lockheed Martin joined in, along with the Spanish National Police, the Los Angeles Superior Court, SoftBank, Argentina's state oil company, a Swiss canton, a UK hedge fund, two universities, a hospital, and three additional international banks. A partial list of these organizations is at the bottom of this post.
Over the next 27 hours, in four distinct waves, all of them tried to use my VoIP (SIP) server to place phone calls on my dime. This is a scam called International Revenue Share Fraud (IRSF). The idea is simple: the attacker gets your phone system to dial an international premium-rate number that they secretly own, and they pocket a cut of every minute. It's the phone version of an open mail relay, and my server was being probed as the open relay.
Here's what makes "coordinated" more than a figure of speech. Every one of these networks tried to dial the same phone number, and they spoofed the same small set of fake caller IDs: the same handful that surfaced, in the same waves, on servers I run in Los Angeles, New York, and Tokyo. Unrelated infected machines don't independently choose the same disguises, target, and timing. These bots were all taking orders from the same place.
Obviously none of this was sanctioned by Citigroup, Idaho, or Build-A-Bear. What almost certainly happened is more mundane. An employee clicked a bad link, or brought an infected laptop onto the network, and a bot quietly went to work. That bot is now sitting inside a corporate or government network, dialing out to a fraud ring, and it presumably has access to whatever else is on that network.
No harm was done to me. My SIP server is one of a set of honeypots that has now recorded over 11.5 million protocol attacks, and it logs exactly what each attacker was trying to do. But if I were Citigroup, or the State of Idaho, or Build-A-Bear, I'd be less concerned about showing up in this dataset, and more concerned about having a rogue machine on my network.
Check your own network
The good news is that it is trivial to find these rogue machines. Here is a free and easy API that lets you look up whether any recorded attacks came from your network, providing open access to some of the honeypot's historic data. You can check a whole ASN, a set of CIDR ranges, or a single IP, with no signup and no API key.
The API is dirt simple. You can paste these into a browser, or curl them from the command line:
https://api.knock-knock.net/check-asn?asn=<your network number>
https://api.knock-knock.net/check-ranges?ranges=<your CIDRs>
https://api.knock-knock.net/ip/<your IP address>Here's what came back when I checked Build-A-Bear's network (ASN 21811):
curl 'https://api.knock-knock.net/check-asn?asn=21811'
{
"list": "year",
"generated_at": "2026-08-05T05:00:00Z",
"asn": 21811,
"isp": "Build-A-Bear Workshop, Inc.",
"hit_count": 1,
"total_matched": 1,
"truncated": false,
"hits": [
{
"ip": "104.238.197.106",
"hits": 11,
"first_seen": "2026-08-01 21:44:56",
"last_seen": "2026-08-03 06:01:49",
"protocols": [ { "proto": "SIP", "hits": 11, "last_seen": "2026-08-03 06:01:49" } ]
}
]
}The result lists one IP, caught eleven times probing for SIP toll fraud. If that were your ASN, this is the machine to find and isolate. This story is about SIP, but the honeypot watches many protocols, so the same call would report attacks via SSH, RDP, SMB, HTTP, and more.
I would hope that the Citigroup and Lockheed Martin security teams would catch this kind of thing before a bot ever reaches outside their walls. However, they did not, and running a check like this every day is cheap insurance. A rogue machine that can reach my server can also reach the rest of your network, and that is the part that should actually worry you.
- More on the API:api.knock-knock.net
- The honeypot itself:knock-knock.net
- The code (MIT license):github.com/djkurlander/knock-knock
All part of the attack
| Organization | ASN | Sector |
|---|---|---|
| Lockheed Martin Corporation | 6075 | Defense contractor |
| Citigroup Inc. | 1696 | Global bank |
| Build-A-Bear Workshop | 21811 | Toy retailer |
| Direccion General de la Guardia Civil | 212377 | Spanish national police |
| State of Idaho | 54885 | US state government |
| State of Nebraska / Office of the CIO | 2769 | US state government |
| City and County of Denver | 18815 | US city government |
| Los Angeles Superior Court of California | 33015 | US court system |
| Etat du Valais | 214217 | Swiss cantonal government |
| YPF S.A. | 27655 | Argentine state oil company |
| Kalpataru Power | 140154 | Indian power infrastructure |
| SoftBank Corp. | 17676 | Japanese conglomerate |
| LG CNS | 4668 | South Korean IT services |
| Marshall Wace Asset Management | 203818 | UK hedge fund |
| American University of Beirut | 12812 | University |
| The New School | 27616 | US university (NYC) |
| Jisc Services | 786 | UK education/research backbone |
| Madison Co Memorial Hospital | 394139 | US hospital |
| Turkiye Garanti Bankasi | 12903 | Turkish bank |
| Cairo Amman Bank | 48701 | Jordanian bank |
| CSCBank SAL | 34370 | Lebanese bank |