Since 15 September, 27 servers rented from IONOS have made 140,274 attempts to place free calls through what they believed was a small business's internet phone system, each one a test that, on a real exposed system, would put a call on that business's bill and tell the fraudsters the line is theirs to use.
Many small businesses, such as dental offices, law firms and shops, run their own internet phone system (FreePBX, Asterisk or 3CX) on a box in the office or a rented server. If that system is reachable from the internet and will connect a call without a username and password, anyone in the world can make calls on the business's account.
Fraudsters exploit this in two steps.
- •First they scout: they send test calls to thousands of phone systems and watch which ones connect.
- •Then they cash in: they push large volumes of calls through the working systems to numbers that pay them a share of every minute.
The business pays for every one of those minutes, usually learns about it from the bill or a carrier fraud alert, and is generally expected to pay. This is called toll fraud, or International Revenue Share Fraud.
Our honeypot pretends to be one of those exposed systems. This report covers the scouting step of one operation: 27 IONOS servers sending test calls to 22 London numbers. Those numbers are the most useful lead, because the UK carrier that holds them can see who receives the calls, and may be able to stop the payouts.
Summary
- •The harm: a small business whose phone system answers these test calls can be used to run up thousands of fraudulent calls, and its carrier will generally bill the business, not the fraudster.
- •140,274 test calls from 27 IONOS SE servers to our fake office phone system, 15 Sep to 23 Oct 2026, on 35 of 39 days.
- •All aimed at 22 London numbers (9 in 020 3807, 13 in 020 3996): the numbers the operator watches to learn which systems connected, and possibly where it collects money.
- •This one operation made 42% of every call attempt the honeypot logged (140,274 of 331,912).
- •It is still running: 32,019 test calls since 20 Oct to 6 new numbers, from 8 servers, with the dialing already tuned to what works.
What happens to a victim
- •The business is found. Its phone system answers on the internet, typically because it was installed with default settings or a firewall was never closed.
- •A test call goes through. A server like the 27 in this report asks the system to dial a London number with no login. If the call connects, it is charged to the business, and the operator now knows this system will dial anywhere.
- •The calls start. The operator, or a buyer of the access, pushes many calls through the system to international or premium numbers that pay it per minute. NCSC advises businesses to restrict evening, weekend and holiday calling for this reason.
- •The bill arrives. The business finds out from its invoice or a carrier fraud alert. By then the calls have been made and the operator has been paid.
- •The dispute. UK guidance is that the phone system owner will be expected to pay. NCSC tells businesses to check their contracts for who carries the loss, for example when a managed provider's setup is exploited.
Once inside, criminals can route high-rate international or premium-rate numbers through the system. These attacks (also known as 'dial-through fraud') are generally prolonged and involve expensive telephone numbers being dialled hundreds or even thousands of times. ... as the business owner you will be expected to pay the bill.
NCSC, Private Branch Exchange (PBX) best practice, ncsc.gov.uk/guidance/private-branch-exchange-best-practice, published 20 Feb 2024
Which means: the UK's national cyber security agency says the victim of this fraud is the business that owns the phone system, and that the business carries the cost.
The losses are large across the industry. The Communications Fraud Control Association (CFCA) estimated telecom fraud losses of 38.95 billion US dollars in 2023 and named PBX fraud, the abuse of business phone systems, among the top methods (cfca.org, 13 Nov 2023). Its 2015 survey put International Revenue Share Fraud at 10.76 billion dollars, the largest fraud type, with PBX and IP PBX hacking at 3.93 and 3.53 billion dollars (as reported by Pipeline Publishing, pipelinepub.com/news/global-telecom-fraud-losses-down-significantly). These are industry-wide estimates; we cannot say how much this operation has earned.
How we know
INVITE sip:00442039961620@[sensor]:5060 SIP/2.0 · From: <sip:2144@85.215.61[.]91:55832> · User-Agent: VOIPSentryPeer capture, 85.215.61[.]91 (IONOS SE), October 2026; honeypot address withheld
Which means: an IONOS server asked our fake phone system to dial London 020 3996 1620, pretending to be office extension 2144, without any username or password. On a real exposed system this call would have been placed and charged to the business.
The five most-called London numbers
| London number | Test calls | Servers | Active (ET) |
|---|---|---|---|
| +44 20 3807 2029 | 19,273 | 1 | Oct 5 to Oct 9 |
| +44 20 3807 2848 | 16,460 | 2 | Sep 19 to Oct 19 |
| +44 20 3807 2846 | 15,642 | 2 | Sep 19 to Oct 19 |
| +44 20 3996 2816 | 13,996 | 6 | Sep 15 to Oct 7 |
| +44 20 3996 3259 | 6,929 | 4 | Oct 20 to Oct 23 |
A few numbers are called tens of thousands of times. Counts include all sources.
Which means: a few numbers are called tens of thousands of times. A real caller would never do this; an operator that only needs to see whether any call arrives, from any phone system, would. Counts include all sources; IONOS servers sent 93% of the calls to these two London blocks.
- •Dialing tried: 23,173 different ways of writing the 22 numbers, using the international dialing codes of Europe, the US, Japan, Brazil and Russia
- •Fake caller names: 34,535 different office extension names before 20 Oct
- •Password guessing: 14,733 attempts by 5 of the servers to log in as a real phone extension
Which means: the operator does not know which country or phone system it is talking to, so it tries every dialing format until one works. It also tries to steal real extension logins, which would let it place calls even on systems that do require a password.
16 of the 27 servers were already tagged by the sensor's reputation list as known SIP abusers or attackers when captured. Across our other sensors, the servers dialing these numbers did almost nothing but phone traffic. Which means: these are dedicated phone-fraud machines, not general scanners.
How it works
Daily test calls from the 27 IONOS servers to the 22 London numbers, 15 Sep to 23 Oct 2026, by America/New_York day (chart in the figure below). Source: CSRF SentryPeer honeypot, Helsinki.
Figure 1. Two waves: 15 Sep to 19 Oct, then a switch to 6 new numbers on 20 Oct. Counts by America/New_York day, 15 Sep to 23 Oct 2026 (23 Oct partial, to 23:23 ET).
Wave 1, 15 Sep to 19 Oct, used 25 servers against 16 numbers and tried 23,045 dialing formats, peaking at 13,414 test calls on 8 Oct. After a near-silent week from 10 to 15 Oct, four new servers appeared on 19 Oct, and at 07:46 ET on 20 Oct wave 2 switched to 6 numbers never called before. Wave 2 uses only 128 dialing formats.
Which means: the operator appears to have learned which formats get through and stopped guessing, so each test call is now more likely to succeed against a real system. Changing numbers and servers together looks like a deliberate rotation, possibly after the old ones were reported. Both points are inference.
Why the London numbers matter: every test call ends at one of them, so they are how the operator sees which systems connected (inference). If they are also numbers that pay the operator per call, every test call earns money too. Either way, the carrier that holds the numbers can see who receives the calls and can suspend them, which would blind the operator and cut off any payouts in one step.
Our honeypot never completes a call, so we cannot confirm any real business has been billed, or that the London numbers pay out.
What to do
Small businesses with their own phone system, and the IT providers who run them
- •Make every call require a login: turn off anonymous or guest calling (in Asterisk and FreePBX,
allowguest=noandalwaysauthreject=yes), and only accept phone traffic from your carrier's addresses. - •Turn off international and premium-rate dialing unless you need it, and block calls outside business hours if you can.
- •Ask your carrier today for a daily spend cap and an alert on unusual calling.
- •Check your call logs for calls you did not make, especially to unknown international or premium numbers, or to any +44 20 3807 or +44 20 3996 number in this report. If you find any, call your carrier's fraud line immediately.
- •Block phone traffic from the 27 server addresses in the indicator table.
IONOS abuse team
- •Investigate and suspend the 27 servers in the indicator table; the 8 wave 2 servers were active as of 23 Oct 2026, 23:23 ET.
- •Check the customer accounts behind them for further servers running the same SIP tools.
The UK carrier holding the London ranges
- •Review the account that receives calls on +44 20 3807 1931, 2029, 2843 and 2845 to 2851, and +44 20 3996 0747, 1556, 1620, 1669, 1916, 2635, 2726, 2746, 2786, 2816, 3259, 3597 and 6113.
- •Look for many short calls arriving from many unrelated business lines since 15 Sep 2026; suspend the numbers and withhold any revenue share if confirmed.
- •Use the calling lines in your records to identify businesses whose systems have already connected, and warn them.
Indicators
IONOS SE addresses (27)
| Type | Indicator | Note |
|---|---|---|
| IP address | 31[.]70[.]90[.]134 | IONOS SE; 20,084 test calls; active Sep 19 to Oct 22 (ET) |
| IP address | 31[.]70[.]105[.]127 | IONOS SE; 19,273 test calls; active Oct 5 to Oct 9 (ET) |
| IP address | 87[.]106[.]201[.]203 | IONOS SE; 15,381 test calls; active Sep 19 to Oct 16 (ET) |
| IP address | 31[.]70[.]73[.]121 | IONOS SE; 13,005 test calls; active Sep 15 to Oct 14 (ET) |
| IP address | 31[.]70[.]65[.]40 | IONOS SE; 11,853 test calls; active Sep 17 to Oct 16 (ET) |
| IP address | 31[.]70[.]77[.]230 | IONOS SE; 11,282 test calls; active Sep 17 to Oct 16 (ET) |
| IP address | 31[.]70[.]96[.]84 | IONOS SE; 9,541 test calls; active Sep 19 to Oct 19 (ET) |
| IP address | 85[.]215[.]61[.]91 | IONOS SE; 7,181 test calls; active Oct 19 to Oct 23 (ET) |
| IP address | 217[.]160[.]220[.]90 | IONOS SE; 5,659 test calls; active Oct 19 to Oct 23 (ET) |
| IP address | 85[.]184[.]251[.]234 | IONOS SE; 5,642 test calls; active Oct 19 to Oct 23 (ET) |
| IP address | 85[.]215[.]58[.]207 | IONOS SE; 5,420 test calls; active Oct 19 to Oct 23 (ET) |
| IP address | 82[.]165[.]231[.]177 | IONOS SE; 5,016 test calls; active Oct 20 to Oct 23 (ET) |
| IP address | 87[.]106[.]206[.]31 | IONOS SE; 4,152 test calls; active Sep 24 to Oct 8 (ET) |
| IP address | 31[.]70[.]74[.]210 | IONOS SE; 1,109 test calls; active Sep 19 to Oct 21 (ET) |
| IP address | 31[.]70[.]103[.]164 | IONOS SE; 1,084 test calls; active Oct 5 to Oct 7 (ET) |
| IP address | 31[.]70[.]105[.]186 | IONOS SE; 1,025 test calls; active Oct 7 to Oct 11 (ET) |
| IP address | 31[.]70[.]103[.]88 | IONOS SE; 672 test calls; active Sep 30 to Oct 6 (ET) |
| IP address | 87[.]106[.]223[.]41 | IONOS SE; 617 test calls; active Oct 3 to Oct 6 (ET) |
| IP address | 85[.]215[.]38[.]164 | IONOS SE; 608 test calls; active Sep 16 to Sep 18 (ET) |
| IP address | 31[.]70[.]97[.]105 | IONOS SE; 512 test calls; active Oct 5 to Oct 6 (ET) |
| IP address | 31[.]70[.]64[.]117 | IONOS SE; 511 test calls; active Oct 5 to Oct 6 (ET) |
| IP address | 217[.]154[.]232[.]205 | IONOS SE; 389 test calls; active Oct 5 to Oct 6 (ET) |
| IP address | 82[.]223[.]243[.]26 | IONOS SE; 167 test calls; active Oct 18 to Oct 19 (ET) |
| IP address | 217[.]160[.]124[.]58 | IONOS SE; 50 test calls; active Sep 30 to Oct 15 (ET) |
| IP address | 82[.]165[.]65[.]238 | IONOS SE; 27 test calls; active Sep 20 (ET) |
| IP address | 87[.]106[.]201[.]248 | IONOS SE; 9 test calls; active Sep 15 to Sep 25 (ET) |
| IP address | 85[.]215[.]59[.]234 | IONOS SE; 5 test calls; active Oct 21 (ET) |
Destination numbers (22 London numbers)
| Type | Indicator | Note |
|---|---|---|
| Phone number | +44 20 3807 1931 | Destination block +44 20 3807 |
| Phone number | +44 20 3807 2029 | Destination block +44 20 3807 |
| Phone number | +44 20 3807 2843 | Destination block +44 20 3807 |
| Phone number | +44 20 3807 2845 | Destination block +44 20 3807 |
| Phone number | +44 20 3807 2846 | Destination block +44 20 3807 |
| Phone number | +44 20 3807 2847 | Destination block +44 20 3807 |
| Phone number | +44 20 3807 2848 | Destination block +44 20 3807 |
| Phone number | +44 20 3807 2849 | Destination block +44 20 3807 |
| Phone number | +44 20 3807 2851 | Destination block +44 20 3807 |
| Phone number | +44 20 3996 0747 | Destination block +44 20 3996 |
| Phone number | +44 20 3996 1556 | Destination block +44 20 3996 |
| Phone number | +44 20 3996 1620 | Destination block +44 20 3996 |
| Phone number | +44 20 3996 1669 | Destination block +44 20 3996 |
| Phone number | +44 20 3996 1916 | Destination block +44 20 3996 |
| Phone number | +44 20 3996 2635 | Destination block +44 20 3996 |
| Phone number | +44 20 3996 2726 | Destination block +44 20 3996 |
| Phone number | +44 20 3996 2746 | Destination block +44 20 3996 |
| Phone number | +44 20 3996 2786 | Destination block +44 20 3996 |
| Phone number | +44 20 3996 2816 | Destination block +44 20 3996 |
| Phone number | +44 20 3996 3259 | Destination block +44 20 3996 |
| Phone number | +44 20 3996 3597 | Destination block +44 20 3996 |
| Phone number | +44 20 3996 6113 | Destination block +44 20 3996 |
Stay Protected
Use our free tools to protect yourself from the threats discussed in this investigation.