跨国企业成电话诈骗肉鸡
推荐指数 43.0 NO. 021 · 2026.08.06
发布2026/08/05Score54Comments16
为什么值得看
花旗银行、洛克希德马丁、软银等数十家机构的服务器被劫持，攻击者利用其VoIP基础设施拨打欺诈电话。文章提供了一套检测脚本，帮助排查自有机器是否沦为同类"国际收入分成欺诈"（IRSF）的跳板节点。
编辑判断
IRSF 是电信黑产里利润极高但技术讨论极少的领域，攻击者通过劫持企业 PBX 或 SIP 中继拨打高费率国际号码，与号码持有者分成。传统安全团队盯着 HTTP 日志，却几乎不审计 5060 端口的异常注册和 INVITE 流量。
这篇文章的检测方法值得所有有语音基础设施的团队今晚跑一遍，尤其是用了 FreeSWITCH、Asterisk 或云 PBX 但没做源 IP 白名单的中小公司。更深层的问题是：这些机构的 SIP 服务为何能暴露在公网且缺乏认证？答案通常是"某次合并遗留的老系统没人管"，而这正是攻击者的狩猎目标。
社区反馈
正面 8 条评论
核心争论：大企业安全失守不可避免，关键在于检测响应速度而非绝对防御
相关内容
This is quite the claim (and I'm not saying you are wrong from making it). I just would have expected some of these institutions to be better.
Yes - I would have expected better from these institutions as well, but there's always going to be someone who brings their rogue laptop onto the corporate net. The key is how fast the security catches it. They can use the api that I describe in the blog to check my honeypot for their IPs. Very simp
Hell of an opening on this blog post. Solid write up! Glad honeypots like this exist.