Calling Number Analysis

ClearIP’s Robocall Mitigation solution analyzes the calling number to determine if the call is likely to be a robocall based on a variety of methods such as historical SPAM activity, invalid number formats, or known Do Not Originate numbers.

Monitor Calling Numbers with Historical SPAM Activity

ClearIP’s Reputation Policies can check the calling number to determine if it has been identified as a robocall source by external networks. This feature has two benefits:

1. It fulfills compliance with the FCC’s robocall mitigation requirement. It identifies calls that have been identified as robocalls and enables the customer to take remedial action.
2. It alerts the customer that the calling number reputation of a subscriber has been damaged by fraudsters who have spoofed the calling number for illegal robocalling. TransNexus can assist in restoring the reputation of the subscriber’s calling number.

The reputation service will lookup the calling number in a reputation database and obtain a reputation score from 0 - 100. The higher the score the more likely the call is to be a known robocaller or spammer. The reputation database and scores are updated in real-time with data externally sourced from a variety of methods: end user feedback, historical data, live traffic flows, honeypot numbers, and more.

If a reputation lookup is performed on a call, then the SIP Message field Reputation Score will show the returned score.

The Reputation Score column is not displayed in the SIP Messages page by default. To view it, you will need to click on the Columns button and select the Reputation Score option. You can find the option by entering the name into the search field.

Monitor Calling Numbers with Invalid Number Formats

ClearIP’s Inbound Shield Policies can check if the calling number has an invalid number format. Invalid number formats may include calling numbers

• with too few digits
• with too many digits
• within number blocks that have not been assigned by the Number Pooling Administrator for use by any carrier
• using an unassigned area code.

Monitoring for invalid calling numbers can be used to find calls where the calling number has been spoofed. The Inbound Shield may not detect calling numbers that are spoofed to have a valid number format.

If a call is determined to be an invalid calling number, then the SIP Message field Invalid Calling Number is set to Yes. Otherwise, this field is set to No.

In this example, the calling number has been marked as invalid because the area code 592 has not been assigned for use by the North American Numbering Plan Administrator.

Monitor Calling Numbers from Do Not Originate database

In addition to monitoring for invalid calling numbers, the Inbound Shield Policies can monitor for high risk calling numbers.

The Inbound Shield database also contains a TransNexus curated list of high risk calling numbers. If a call is determined to be a high risk calling number, then the SIP Message field High Risk Calling Number is set to Yes. Otherwise, this field is set to No.

In this example, the calling number has been marked as high risk because the number was listed in the Traceback Group DNO database.

Setup

The outbound robocall mitigation service can be enabled by configuring the Reputation Policies and Inbound Shield Policies as described below. If you are using ClearIP for both outbound robocall mitigation and inbound robocall prevention, then you may have multiple policies created in each page.

Enable Reputation Lookup on Outbound Calls

The reputation service can be enabled in the Reputation Policies page under the Inbound menu.

To enable the service, a policy must be created by clicking on the green Add button. In the pop-up modal, the following fields can be set:

• Called Number field can be left blank which acts as a wildcard
• Status can be left as Enabled
• Action can be left to Report Only
• The policy should be restricted to apply to outbound calls. This can be done by selecting the appropriate Service Provider field or Operator field.

Enable Inbound Shield Lookup on Outbound Calls

The Inbound Shield service can be enabled in the Inbound Shield Policies page under the Whitelist/Blacklist menu.

To enable the service, a policy must be created by clicking on the green Add button. In the pop-up modal, the following fields can be set:

• Called Number field can be left blank which acts as a wildcard
• Status can be left as Enabled
• Inbound Calling Number Action can be left to Report Only
• High Risk Calling Number Action can be left to Report Only.
• The policy should be restricted to apply to outbound calls. This can be done by selecting the appropriate Service Provider field or Operator field.

Acceptance Test

Calling Number Reputation

1. Go to the ClearIP Reputation Policies page as shown in the screenshot below.

2. Click on the green Add button to open text box shown in the following screenshot, to add a Reputation policy. Select the operator or service provider for outbound calls, enable the status and set the action to report only.

3. Generate an outbound call from calling number 1-212-555-9100. The call should complete as expected.

4. Check the calling number reputation score is 100. Go to the ClearIP SIP Messages page as shown in the following screenshot.

5. Click on the Columns button and select the Robocall Mitigation option. This displays a set of columns related to robocall mitigation.

6. Check the Reputation Score for 12125559100. It should be 100 which is the score that indicates the maximum level of robocall activity. Note that the High Risk Calling Number column is “No”. Reputation analysis is different and more dynamic than Inbound Shield. The High Risk Calling Number and Reputation scores may not always agree, but if either indicates a problem, then the calling number should be investigated.

7. Additional tests can be made with the following calling numbers. These numbers are reserved for testing with preset reputation scores.

Inbound Shield

1. Go the ClearIP Inbound Shield Policies page as shown in the following screenshot.
2. Click on the green Add button to open the following text box to provision the Inbound Shield database for outbound calls. Set the actions to “Report Only” so unusual calling numbers will be identified, but calls will not be blocked. Configure the policy for the correct Operator or Service Provider, so it applies to all outbound calls.

Once submitted, the rule is displayed like this.

3. Make a test call from a known high risk calling number. Spoof the calling number 1-800-252-3563. This is the number of a telemarketing identified from the FCC’s complaint database.

4. Check the SIP Messages page to verify the call from 1-800-252-3563 has been identified as a High Risk Calling Number. In the example below, the High Risk Calling Number column is “Yes”, indicating the calling number is high risk.

Diversion Header on Forwarded Calls

1. Enable call forwarding on your test line to forward calls to a long distance number for testing with ClearIP.
2. Use another phone to place a call to your test line.
3. Check the SIP Messages page. If the Diversion header is sent in the SIP Invite, then the Forwarded field should be set to Yes.
4. Click on the blue Show button on the right side to view the SIP Invite. You should see the Diversion header present in the SIP Invite.

INVITE sip:17739315301@sip.clearip.com:5060 SIP/2.0
Via: SIP/2.0/TLS sip.clearip.com:5061;branch=z9hG4bKddb6.39d89de32239fc0cfe5435d0b45e8e4b.0;i=9acd8307;received=::ffff:10.0.12.18
Via: SIP/2.0/TCP 1.1.1.1:5060;branch=z9hG4bK1sansay4021338771rdb37271
Record-Route:  <sip:sansay4021338771rdb37271@1.1.1.1:5060;lr;transport=tcp>
To:  <sip:17739315301@sip.clearip.com>
From: <sip:16788029149@1.1.1.1;otg=001391;qtype=ers>;tag=sansay4021338771rdb37271
Call-ID: ers-482735014-0-3104171908@3.3.3.3
CSeq: 1 INVITE
Contact:  <sip:16788029149@1.1.1.1:5060>
Diversion: <sip:+16089577984@2.2.2.2;user=phone>;reason=unconditional;counter=1
H323-Conf-Id: 1623427812-927438675-2182869500-1380683835
Allow: INVITE, ACK, CANCEL, BYE, REFER, NOTIFY, OPTIONS, INFO, REGISTER, SUBSCRIBE, MESSAGE
Max-Forwards: 67
Content-Length: 0
X-Real-Ip: 1.1.1.1