Reputation Policies

ClearIP can determine if an inbound call is a possible scam or robocall based on the reputation of the calling number. The Reputation Policies page under the Inbound Services dropdown menu allows granular control over when a reputation lookup should be performed and what action should be performed for a poor reputation calling number.

Setup

For each call where a reputation policy is enabled, ClearIP looks at the calling number, queries a reputation database and gets a reputation score from 0 - 100. The higher the score, the more likely the call is to be a known robocaller or spammer. If the returned reputation score is higher than the configured threshold, ClearIP can take action on the call.

Reputation lookup is disabled by default unless a policy exists that explicitly enables it.

The Action field defines what action should be taken if a reputation lookup is performed and a poor reputation is found. Options include:

• Indicate - The CNAM value (if present) will be overridden with “<SPAM>”.
• Block - The call will be blocked.
• Divert - The call will be diverted to the diversion device.
• Report - The reputation score will only be recorded in the SIP message record.

The Reputation Score Threshold determines which calls are flagged as robocalls. Calls with reputation scores greater than the threshold are considered robocalls. The threshold is pre-filled with the value of 79, so that calls with a reputation score of 80 or more are flagged. The threshold value can be altered depending on which calls should be allowed, indicated as SPAM, blocked, or diverted.

To enable reputation lookups for inbound calls, the policy should be restricted to inbound calls by either selecting the relevant Service Provider or Operator field.

Reputation lookup can be enabled for individual called numbers or ranges by specifying a full called number or a prefix in the Called Number field. This allows the service provider to offer robocall prevention as an opt-in, value-added service to its subscribers for an additional monthly charge.

Reputation lookup can also be enabled for all subscribers by creating a policy with a blank Called Number field and Status set to Enabled. If any subscriber chooses to not have their calls monitored for robocalls, the service can be opted out of by creating a reputation policy their DID with the Status set to Disabled.

SPAM Indication

If the Action is set to Indicate in the Reputation policy and a high-risk calling number is detected, ClearIP can overwrite the current CNAM value (if one is present) with “<SPAM>” which is returned in the SIP 302 response. By default, CNAM values are returned in the P-Asserted-Identity header, but this can be configured. Below is a sample SIP response with a spam indicator.

SIP/2.0 302 Moved Temporarily
Via: SIP/2.0/TCP sip.clearip.com:5060
From: <sip:+14045266060@transnexus.com:5060>
To: <sip:+18554742536@sip.clearip.com:5060>
P-Asserted-Identity: "<SPAM>" <sip:+14045266060@transnexus.com:5060>
Contact: <sip:+18554742536@sip.clearip.com:5060>;q=0.99
Reason: SIP;cause=302;text="no-fraud-detected"
Call-ID: 123456
CSeq: 1 INVITE
Content-Length: 0

If the Action is set to Indicate in the Reputation policy and no high-risk calling number is detected, ClearIP does not modify the current CNAM value (if one is present) which may have been supplied by ClearIP or an external source.

If the Action is set to Indicate in the Reputation policy and the STI Verification Policies have been set to indicate call verification in CNAM, a high-risk, successfully verified call will be given the following CNAM value by ClearIP (in the P-Asserted Identity header, unless configured differently): “[V]<SPAM>”.

If a ClearIP user plans to use the SPAM indication feature in Reputation Policies, it should be ensured that any CNAM provisioning or modification functions external to ClearIP take place before the call is sent to ClearIP, so that the SPAM indication is not overwritten. If ClearIP is used as the CNAM provider, ClearIP automatically does a CNAM lookup before doing a reputation lookup.

NOTE: Netsapiens users must set the Action to Indicate for the Netsapiens to treat the call as SPAM. Different SPAM treatment options should be configured in the User Answering Rules and not within ClearIP.

Reporting

SIP Messages

The reputation scores of calls previously made can be viewed in the SIP Messages page by checking off column Reputation Score from the Columns button.

A reputation score is reported for all SIP records. This score ranges from 0 to 100. A score of 0 indicates that no reputation lookup was performed, no reputation was found, or a calling number with normal behavior. Scores of 1 through 100 are used to indicate how suspicious a calling number might be, where 1 is the least suspicious and 100 is the most suspicious.

A reputation lookup flag is set for all SIP records. Only calls with this flag set to Yes will be billed for reputation lookup. This is shown in the SIP Messages column Reputation Lookup.

SIP Reports

ClearIP’s reporting tools enable the monitoring and investigation of any suspected robocalls.

To view the reputation reports, go to the SIP Reports page under the Analytics dropdown menu.

By default, ClearIP will display the number of calls made to specific countries within the past hour. The SIP Report needs to be modified by choosing the desired settings. The Load Canned Reports button can be clicked to view and select preconfigured report options.

The Calling Numbers with Reputation Score Above 0 option can be selected as the report type to monitor suspicious calling numbers.

Calling Numbers with Reputation Score Above 0 Report

This report will automatically display the calling numbers with reputation scores higher than zero, the number of calls received during the selected time period, and the reputation scores (minimum, maximum and average) associated with each calling number.

Robocalls to a Specific Subscriber

Some service providers like to provide data to their subscribers about how many robocalls have been blocked recently to demonstrate the effectiveness of the service. To build a report that shows the total number of robocalls that have been blocked for each DID in a specified time period:

1. Specify the time period in the From and To fields.
2. Add a Filter with Filter By set to Reputation Score, Filter Type set to Greater Than, and Filter Value set to the configured reputation score threshold (i.e. 79).
3. Set the Primary Group By to Translated Called Number.
4. Use the Columns button to change the visible columns to the following columns:
   1. Translated Called Number
   2. Count
   3. SIP 603 Count

Return Reputation Score in SIP response

If the reputation service is enabled, ClearIP can be configured to return the reputation score in the SIP 302 response. This can be enabled in the SBCs page by setting the Return Reputation Score In SIP Response field to Yes. The reputation score is sent in an X-Reputation-Score header, shown I the below sample SIP response.

SIP/2.0 302 Moved Temporarily
Via: SIP/2.0/TCP sip.clearip.com:5060
From: <sip:+14045266060@transnexus.com:5060>
To: <sip:+18554742536@sip.clearip.com:5060>
X-Reputation-Score: 100
P-Asserted-Identity: "<SPAM>" <sip:+14045266060@transnexus.com:5060>
Contact: <sip:+18554742536@sip.clearip.com:5060>;q=0.99
Reason: SIP;cause=302;text="no-fraud-detected"
Call-ID: 123456
CSeq: 1 INVITE
Content-Length: 0

Reputation Lookup Service Test

It is possible to conduct acceptance tests of the reputation lookup service after initial setup. The following calling numbers are reserved for testing with preset reputation scores.

To conduct a test, make a spoofed outbound call with one of the above calling numbers. Depending on the reputation rule configuration, ClearIP will take the specified action based on the configured threshold. The outcome of the call can be viewed on the SIP Messages page under the Analytics dropdown menu. On the SIP Messages page, click on the Columns button and select the Robocall Mitigation option. This displays a set of columns related to robocall prevention, including Reputation related columns. The record for the test call can be found by filtering the Asserted Calling Number with the calling number used to make the outbound call.