[VoiceOps] Suspect NPANXX question

[Jim Dalton]

Here is what we know about 1-268-762.

On July 22, 2014, Telstra reported 1268762015 to the list maintained by the
GSMA Fraud and Security Group.

On Sept. 1, 2014, we recorded that 12687620310 was a premium rate test
number advertised by www.cyclone.li

On Sept. 1, 2014, we recorded that 12687620001 was a premium rate test
number advertised by iprn.me.  This website is no longer available.

Jim D.

-----Original Message-----
From: VoiceOps [mailto:voiceops-bounces at voiceops.org] On Behalf Of Ryan
Delgrosso
Sent: Tuesday, August 04, 2015 2:34 PM
To: voiceops at voiceops.org
Subject: [VoiceOps] Suspect NPANXX question

All,
We have seen a Caribbean NPANXX (1-268-762) advertised to us from a US tier
1 vendor. It has drawn a large amount of fraudulent traffic.

We first saw this prefix pop up in this vendors rate decks in April. 
Going back to the start of the year I cannot find it in any revision of the
LERG though, and no other vendor I have offers routes/pricing to this
prefix.

Does anybody know whats going on here?

Shouldn't any zone 1 prefix exist in the LERG months prior to going live, or
at the very least within some reasonable time after showing up for live
traffic?

Does this smell like highjacking to anyone else?

All our vendor will tell is they are getting the route from another T1
vendor, but in my 20+ connected peers I cannot find another occurrence.


Any help or guidance is much appreciated. Feel free to reply on or off 
list.

-Ryan
_______________________________________________
VoiceOps mailing list
VoiceOps at voiceops.org
https://puck.nether.net/mailman/listinfo/voiceops