The Inbound Shield service can check if the calling number is an invalid or high-risk calling number to detect some types of call spoofing.
ClearIP’s Inbound Shield Policies can check if the calling number has an invalid number format. Invalid number formats may include calling numbers:
- with too few digits
- with too many digits
- within number blocks that have not been assigned by the Number Pooling Administrator for use by any carrier
- using an unassigned area code.
The Inbound Shield database also contains a TransNexus curated list of high-risk calling numbers.
Monitoring for invalid calling numbers can be used to find calls where the calling number has been spoofed. The Inbound Shield may not detect calling numbers that are spoofed to have a valid number format.
The Inbound Shield service can be enabled in the Inbound Shield Policies page under the Whitelist/Blacklist dropdown menu.
The Inbound Shield Policies allow for granular control over when lookups in the Inbound Shield database should be performed and what action should be performed for an invalid or high risk number.
Setup
A lookup against the Inbound Shield service is disabled unless a policy exists that explicitly enables it. The lookup can be enabled for all calls by creating a policy on the Inbound Shield Policies page where Called Number is blank, and Status is Enabled. Lookups can also be enabled for individual numbers or ranges by specifying a full number or a prefix in the Called Number field when creating a new policy.
The Invalid Calling Number Action and High Risk Calling Number fields define what action should be taken if the calling number is flagged for either case. Options include Block (block the call), Divert (divert the call to the diversion device), Indicate (replace the CNAM with “<SPAM>”), or Report (only report the status in the SIP message record).
The custom whitelist/blacklist is analyzed before the Inbound Shield service. Calls whitelisted, blacklisted, or diverted by the custom lists will not have any Inbound Shield lookup performed and will not be billed for Inbound Shield lookups. The Inbound Shield lookup is performed before the Outbound Shield lookup. This means that calls whitelisted, blacklisted, or diverted by the Inbound Shield service will not have the Outbound Shield lookup performed and will not be billed for Outbound Shield lookups.
Reporting
Calls flagged by the Inbound Shield service can be viewed in the SIP Messages and SIP Reports pages under the Analytics dropdown menu.
SIP Messages
In the SIP Messages page, manually enable columns for Invalid Calling Number, High Risk Calling Number, and Inbound Shield by clicking on the Columns button, searching for the relevant columns, and checking them off.
The Inbound Shield field indicates whether an Inbound Shield lookup was performed for the call. Calls with this field set to Yes will be billed for the Inbound Shield lookup.
The Invalid Calling Number field indicates whether the calling number was found to be invalid if an Inbound Shield lookup was performed.
The High Risk Calling Number field indicates whether the calling number was found to be high risk if an Inbound Shield lookup was performed.
SIP Reports
ClearIP’s reporting tools enable the monitoring and investigation of any calls flagged by the Inbound Shield database.
On the SIP Reports page, ClearIP will display the number of calls made to specific countries within the past hour by default. The SIP Report should be modified to the desired settings to review Invalid or High Risk Calling Numbers. The Load Canned Reports button shows the preconfigured report options that can be selected. The two types of reports to monitor suspicious calling numbers detected by the Inbound Shield database are:
- High Risk Calling Numbers
- Invalid Calling Numbers
High Risk Calling Numbers Report
If this report is selected, ClearIP will automatically display the calling numbers flagged by the Inbound Shield high risk number database and the number of calls received during the selected time period. This report shows suspected spoofed calls with Do Not Originate calling numbers leaving the network.
Invalid Calling Numbers Report
If this report is selected, ClearIP will automatically display the calling numbers flagged by the Inbound Shield invalid number database and the number of calls received during the selected time period. This report shows suspected spoofed calls with invalid calling number formats leaving the network.