I made 50k calls to explore the telephone network

&gt; I was very surprised to hear this bizarre message about the end of the world and a zombie apocalypse when listening to the recordings.<p>So that&#x27;s the reason someone called, we thought zombie apocalypse had already started...is what I would like to say, but reality is a bit more boring. It&#x27;s one of our test numbers that we used for integration testing one of our call center integrations for our WebRTC monitoring platform (<a href="https:&#x2F;&#x2F;www.callstats.io" rel="nofollow">https:&#x2F;&#x2F;www.callstats.io</a>) and someone decided to have a bit of fun with call flow :)<p>If you had pressed 1, you would have got a message about choosing to be rescued and that the agents take long tea breaks.<p>(disclaimer: I work at 8x8 on the callstats product)

I am the author of WarVOX (a mostly dead project these days). Some useful links:<p>- WarVOX 2.0 Presentation: <a href="https:&#x2F;&#x2F;speakerdeck.com&#x2F;hdm&#x2F;derbycon-2011-acoustic-intrusions" rel="nofollow">https:&#x2F;&#x2F;speakerdeck.com&#x2F;hdm&#x2F;derbycon-2011-acoustic-intrusion...</a> - WarVOX Source: <a href="https:&#x2F;&#x2F;github.com&#x2F;rapid7&#x2F;warvox" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;rapid7&#x2F;warvox</a><p>The US legal restrictions on wardialing are complicated and changes to the law made it difficult to continue the project.<p>For fans of ToneLoc, I implemented the data format and visualization with my latest project (Rumble Network Discovery): - <a href="https:&#x2F;&#x2F;www.rumble.run&#x2F;blog&#x2F;subnet-grid-report&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.rumble.run&#x2F;blog&#x2F;subnet-grid-report&#x2F;</a>

The author says that lots of measures were taken not to wake people up in the middle of the night, but that despite those efforts 3 people were. Wouldn&#x27;t the most obvious method have been not to dial numbers at night local time?

&gt;There was a single response that was present in 1074 answered calls (91% of all interesting answers) and that waits for the caller to interact with itself. It says “Tervetuloa palveluun” (Welcome to the service) followed by repeating “Anna tunnusluku” (Please give access code). The machine does not give any hint of what kind of service it is.<p>I wonder whats that about.

&gt;As there are no Shodan-like search engines for the telephone network, I needed to do the exploration myself.<p>in the 2000&#x27;s there was a massive telephone search engine hosted at bellsmind.net. You could find brief descriptions of hundreds of thousands of phone numbers. You could just run down a list of 800 numbers and call the ones that looked interesting. Some presented you with a new dialtone. Some played weird little jingles. Some lead you to a real person. A few were set up by phone hobbyists and let you play games.<p>At some point the law caught up with BellsMind and the database was taken down. The whole site is gone now - even the blog.<p>You can see remnants of that database here (just skip through time to see new stuff - the rest is <i>mostly</i> broken): <a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20041015131435&#x2F;http:&#x2F;&#x2F;bellsmind.net:80&#x2F;Engine&#x2F;ListScanned.php" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20041015131435&#x2F;http:&#x2F;&#x2F;bellsmind....</a><p>EDIT: This is the page for &quot;The 944 Project&quot;, which was a crawl of the entire 800-944-XXXX space. Easily the best list at the time. Some stuff might still be there. <a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20050125030027&#x2F;http:&#x2F;&#x2F;bellsmind.net&#x2F;Engine&#x2F;BellsMindParseExtended.php?NPA=800&amp;NXX=944" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20050125030027&#x2F;http:&#x2F;&#x2F;bellsmind....</a>

Dunno what I said the last time a call violated the do-not-call list and woke me. They actually called back later to tell me how shook up they were, and that they&#x27;d been discussing my response with their lawyers.<p>I don&#x27;t see a difference between kidnapping one person for a week, and taking ten seconds away from 56,874 people. I&#x27;d support similar penalties.<p>I decided to fix this problem.<p>Phone.com is aimed at small businesses; if you have three extensions in your house they default to ringing separately like cubicles. However, any HN reader will have no trouble customizing their service.<p>I have one service spanning homes on both coasts. The phone number I give out has a white list, or answers with a recorded message to press 7. Apparently this is enough to evade all robocalls. Successful callers ring the extensions where I&#x27;m scheduled to be, and the Phone.com app on my cell phone.<p>My cell phone is otherwise set to &quot;Do Not Disturb&quot; so it only rings if you&#x27;re in that address book. The Phone.com app is a bit clumsy (it doesn&#x27;t track switching to AirPods once the call starts, for example) but for answering calls it works.<p>Some legitimate businesses robodial numbers before putting on a human. They don&#x27;t get through. Life goes on. They should know better than to appear to be a robocall.

The &quot;unknown machine&quot; sounds like dtmf tones + pulse tones. It&#x27;s anyone&#x27;s guess what the actual meaning of the numbers are, but the tone+pulse encoding suggests a super legacy, perhaps proprietary automated system that you&#x27;d call up to get the status of something - maybe factory machinery or a power plant, but really it&#x27;s anyone&#x27;s guess. Pulse dialing was still somewhat common until the mid 80s so this system is potentially upwards of 40 years old.

That reminds me of this talk I heard a while back (I think this is it: <a href="https:&#x2F;&#x2F;youtu.be&#x2F;Hk-21p2m8YY" rel="nofollow">https:&#x2F;&#x2F;youtu.be&#x2F;Hk-21p2m8YY</a>)<p>The guys working on nmap scanned the entire Internet. That set off some serious alarms because on the target side, it looked like they were aware of the existence of the relationship between IPs&#x2F;assets that were classified. If memory serves some dudes in black suits showed up at their door lol

&gt; To avoid listening to all recordings myself, used Google Cloud Speech-to-Text to transcribe the recordings, and then used the transcriptions<p>... That&#x27;s a lot of trust to place in google. Do all this work to gather data, then throw it away and analyze what google did to the data instead.

Traditional wardialing was almost always looking for modems, but it sounds like the particular number ranges that this researcher selected didn&#x27;t contain any modems at all?<p>I&#x27;m sure there are still plenty of modems connected to landlines, not just for ISPs still offering dialup service, but also for SCADA systems and stuff.

As a pre-teen in the early 90s, I spent hundreds of hours wardialing most of the free-to-dial exchanges. I was lucky enough to have a US Robotics modem that reported the extended result status codes to detect voice, continuous tone, and fax lines.<p>The results were typically for every exchange that 1% of the numbers were modems, 1% were fax machines, 70% were non-intercept recordings or humans, 0.3% were continuous tones and test numbers, and the rest were primarily unallocated or just did not complete.

The &quot;exception&quot; music example isn&#x27;t really an exception. It&#x27;s Passages by Kenny G which is about as hold music as it gets, it&#x27;s just heavily modulated.

Maple confirmation message for Clevercrossing sounds a lot like &quot;Mobile confirmation message for global crossing...&quot;

&gt; Ensured that any recording of private individuals did not end up outside the EU, being saved by third parties, or used to train machine learning models<p>is incompatible with<p>&gt; To avoid listening to all recordings myself, used Google Cloud Speech-to-Text to transcribe the recordings

Regarding: &quot;Maple confirmation message for Clevercrossing.&quot;<p>It sounds like they are saying &quot;Global Crossing&quot; which was a telecom company<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Global_Crossing" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Global_Crossing</a>

I am pretty sure I recognize the hold music. I believe it is from uberconference.com. You likely found one of their teleconference lines. Each paid UC user gets their own local number. When a conference is active, dialing it will connect you immediately to the conference. (Of course, the host can chose to require a PIN, but I never had any unknown drop ins.) It is SO much better than Zoom’s system.

That’s a huge amount of people who didn’t answer. Phones are basically worthless to get ahold of people — I called about 40 students last spring for interviews and got only one answer, myself.

I would like to know more about the zombie apocalypse number

See also, &#x2F;r&#x2F;weirdnumbers and, if you&#x27;re into that sort of thing (that is, exploring the phone network), &#x2F;r&#x2F;phreaking<p>Old-skool phreaking[0] (eg, using blue boxes and red boxes) is mostly dead (at least in the US and most &quot;first world&quot; countries. <i>Maybe</i> there is some vestige of in-band signaling left somewhere else) but there is still some fun to be had exploring phones and phone networks.<p>Modern day phreaking is more about GSM sniffing[1], messing with the SS7 network[2][3][4], using SCTP[5]&#x2F;SIGTRAN stuff[6], etc. etc. But, at least for the land-line &#x2F; PSTN network, even some of the old &quot;colored boxes&quot;[7] still do useful things. You can always beige-box a landline phone, violet-boxes should still work, I think a gold-box would still work, etc.<p>If you want to dig deeper into how the PSTN works, a good, fun book is <i>Understanding Telephone Electronics</i>[8] by Carr, Winder, and Bigelow. Another interesting one is <i>Digital Telephony</i>[9] by Bellamy. Another &quot;oldie but goodie&quot; is <i>Voice and Data Communications Handbook</i>[10] by Bates and Gregory.<p>Also, don&#x27;t ask me how or why I know any of this stuff... :-)<p>[0]: <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Phreaking" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Phreaking</a><p>[1]: <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=wzyuioto4y8" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=wzyuioto4y8</a><p>[2]: <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=0JCusqL-Gdk" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=0JCusqL-Gdk</a><p>[3]: <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=-wu_pO5Z7Pk" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=-wu_pO5Z7Pk</a><p>[4]: <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Signalling_System_No._7" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Signalling_System_No._7</a><p>[5]: <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Stream_Control_Transmission_Protocol" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Stream_Control_Transmission_Pr...</a><p>[6]: <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;SIGTRAN" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;SIGTRAN</a><p>[7]: <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Phreaking_box" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Phreaking_box</a><p>[8]: <a href="https:&#x2F;&#x2F;www.amazon.com&#x2F;Understanding-Telephone-Electronics-Joseph-Carr&#x2F;dp&#x2F;0750671750&#x2F;ref=sr_1_3?dchild=1&amp;keywords=understanding+telephone+electronics&amp;qid=1624461341&amp;s=books&amp;sr=1-3" rel="nofollow">https:&#x2F;&#x2F;www.amazon.com&#x2F;Understanding-Telephone-Electronics-J...</a><p>[9]: <a href="https:&#x2F;&#x2F;www.amazon.com&#x2F;Digital-Telephony-Telecommunications-Processing-2000-01-24&#x2F;dp&#x2F;B01K0RZYNA" rel="nofollow">https:&#x2F;&#x2F;www.amazon.com&#x2F;Digital-Telephony-Telecommunications-...</a><p>[10]: <a href="https:&#x2F;&#x2F;www.amazon.com&#x2F;Voice-Communications-Handbook-McGraw-Hill-Communication&#x2F;dp&#x2F;0072263350" rel="nofollow">https:&#x2F;&#x2F;www.amazon.com&#x2F;Voice-Communications-Handbook-McGraw-...</a>

I&#x27;m surprised they found no modems. I don&#x27;t see any listed. I&#x27;m sure there are still modems on the telco system for things like maintenance lines. I&#x27;ve seen them before in data centers to get into the networking hardware if everything else is down, for SCADA systems, to support really old credit card terminals, etc.

The author also posted an interesting bit on setting up a VOIP&#x2F;SIP honeypot: <a href="https:&#x2F;&#x2F;shufflingbytes.com&#x2F;posts&#x2F;sip-honeypot&#x2F;" rel="nofollow">https:&#x2F;&#x2F;shufflingbytes.com&#x2F;posts&#x2F;sip-honeypot&#x2F;</a><p>Turns out is a ton of automated activity looking to make money via poorly secured phone systems.

Did a similiar thing with ToneLoc in 1993 or 1994 (not 100% sure of exact year, but 1994 at the latest as i still had my 286) using an USR 14400 Sportster in Finland also, but my scan was limited to the 9800&#x2F;0800 1xxxx set which seemed to cover most of the freephone numbers. (I believe 9800 and 0800 were mapped to the same endpoints back then, memory slightly hazy.)<p>I do recall getting far more modem pickups than your run, perhaps it was more popular back then. One that made me wonder back then was a modem answering stating it was a &#x27;Cray Communications CMX&#x27;, sadly now decades later i know that it has nothing to do with the supercomputer manufacturer.

In one of my previous job, I created a fax spamming machine with the same principle: a SIP trunk and an Asterisk machine that bruteforce numeration blocks. After few months we collected an interesting database of fax numbers

Many years ago I did something similar with a piece of software called ToneLoc. I called every number in my my city. The results back then were much more interesting as there were so many more modems and dial in networks.

&gt; 11 Calls were answered with only music. The music could indicate something, such as being in queue for some service. All music variants except for one sounded like generic elevator music that could be the default hold music in PBXs.<p>Someone told me that there used to be actual phone lines playing music 24&#x2F;7 that elevators would dial and output to a speaker. Speaking of elevators, their emergency lines are also usually just phones and, as someone already pointed out in this thread, with enough knowledge you can call the elevator and listen (and talk) to people in it.

Circa 1998 I dialed a random sample of toll-free numbers in the US and found that 20% of them were numeric pagers. So you could write a script that does something like<p><pre><code> ATDT 1800*******PPP[victim] </code></pre> where * are random digits. If you did it 100 times, the victim would get about 20 calls from very confused big shots who had no idea who was calling them. You could make 5000 of those calls a day so it would be quite a hassle.

There&#x27;s people who do this sort of thing in the US network regularly: <a href="https:&#x2F;&#x2F;www.twitter.com&#x2F;shadytel" rel="nofollow">https:&#x2F;&#x2F;www.twitter.com&#x2F;shadytel</a><p>Some of what can be expected to be found in telco test ranges: <a href="https:&#x2F;&#x2F;pastebin.com&#x2F;7KAuZmQq" rel="nofollow">https:&#x2F;&#x2F;pastebin.com&#x2F;7KAuZmQq</a>

Why does audio sound so bad over the phone? Why can we have 1Mbps broadband over these lines but not pristine audio?

i was told once some of the emergency lines on elevators in Germany could be called into once you uncovered their number and expected to read about something similar here but no. Still quite interesting of course.<p>i wonder if these machine-machine range numbers might only accept calls from other machines in that range...

Unrelated to the post, but the thumbnail that loads at the top of this page is very large (and slow to load). <a href="https:&#x2F;&#x2F;shufflingbytes.com&#x2F;images&#x2F;avatar.png" rel="nofollow">https:&#x2F;&#x2F;shufflingbytes.com&#x2F;images&#x2F;avatar.png</a>

&gt; Maple confirmation message for Clevercrossing<p>I think this one actually says “Mobile confirmation message for Global Crossing”. It’s a slightly nasal Brit accent so I can see why it might have been a bit harder to decipher.

When 55150 are unanswered, the title begins to feel clickbaity.

How would one go about getting a phone number in the Finnish machine to machine space? Sounds like a great number to have to avoid robo call spammers.

Maple confirmation message for Clever crossing

I might have written a wardialer and called all my local numbers right after watching the theatrical release of WarGames.

Does anyone else have a problem with this? I often get multiple calls like this a day!<p>I firmly believe that the right to privacy includes a right not to be disturbed at random times on my phone.<p>FIRST: The phone networks need to quickly detect spam like this and block these kind of calls.<p>SECOND: This kind of behavior needs to be considered white-collar crime with appropriate fines, jail time, and other penalties. (Like not being able to have a phone and internet connection.)

&gt;How I tried to avoid scaring people with ghost calls in the middle of the night. (...) You get a call, which you pick up, but the caller remains silent. After a while, the caller hangs up. This alone can feel threatening to some people.<p>And the author&#x27;s solution is... to delete call recordings. What about just playing prerecorded message explaining it? I can&#x27;t help but question intelligence of the author.

is &quot;illegal termination&quot; when you funnel calls via VoIP to some local mobile network operators using sim cards usually provided to customers? like lets say to avoid billing it like a call into another network?

This is wonderful, any thoughts on about doing this in another country?

Avatar describes Moomin characters. These characters were first introduced by Swedish-speaking Finnish illustrator Tove Jansson. I find them very Nordic. But the characters were also adopted by a Dutch-Japanese animation production and they spoke Japanese. I found it also kind of fitting and natural.