https://blog.efespain.com/en/tags/sip/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainSat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-14/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-14/In chapter 9 someone tried to make my phone switch pay for their calls. I wrote it up and closed the incident, with one question left hanging: who was on the other end? This time I didn't just watch through the window. I gave the decoy a memory, followed the number's trail, and found out why they pick exactly those numbers.https://blog.efespain.com/en/chapter-9/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-9/This time no binary landed. A fraud did: for two hours, fifteen machines tried to make my PBX place 3,457 international calls — the trial run of an International Revenue Share Fraud (IRSF), with the bill in my name. A chapter with no Ghidra: just protocol, money and OSINT.