--- title: Citigroup, Idaho, and Build-a-Bear Launched a... description: A VoIP honeypot operator discovered that machines from Citigroup, the State of Idaho, Build-A-Bear, Lockheed Martin, and dozens of other major organizations... canonical: https://daily.dev/posts/citigroup-idaho-and-build-a-bear-launched-a-coordinated-attack-on-me-k9b5p9j26 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Citigroup, Idaho, and Build-a-Bear Launched a Coordinated Attack on Me | daily.dev og:description: A VoIP honeypot operator discovered that machines from Citigroup, the State of Idaho, Build-A-Bear, Lockheed Martin, and dozens of other major organizations... og:url: https://daily.dev/posts/citigroup-idaho-and-build-a-bear-launched-a-coordinated-attack-on-me-k9b5p9j26 og:image: https://api.daily.dev/og/posts/k9b5p9j26.png og:image:alt: Citigroup, Idaho, and Build-a-Bear Launched a Coordinated Attack on Me og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Citigroup, Idaho, and Build-a-Bear Launched a Coordinated Attack on Me **[Hacker News](https://daily.dev/sources/hn)** · 5 min read · 0 upvotes · 0 comments ## Summary A VoIP honeypot operator discovered that machines from Citigroup, the State of Idaho, Build-A-Bear, Lockheed Martin, and dozens of other major organizations were all participating in the same International Revenue Share Fraud (IRSF) botnet. The bots attempted to exploit an open SIP relay to place calls to premium-rate numbers, with all infected machines using identical spoofed caller IDs, targets, and timing — clear evidence of centralized command. The author provides a free, no-signup API to check whether any IP, CIDR range, or ASN in your network has appeared in the honeypot's dataset of over 11.5 million recorded protocol attacks, covering SIP, SSH, RDP, SMB, HTTP, and more. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community take How the wider developer community reacted, aggregated from 1 discussion and 20 comments across hackernews (as of 2026-08-05). **TL;DR:** Commenters are broadly appreciative of the honeypot research and the free API, though some raise concerns about the clickbait-y framing of the title and whether AI was used to write the post. **Sentiment:** 60% positive · 30% mixed · 10% skeptical **The case for** - The honeypot's insight that botnets deliberately route through trusted institutional IP ranges (banks, defense contractors, government) to evade fraud scoring is a genuinely novel observation. - The free, no-signup API letting anyone check their own ASN or IP against 11.5M recorded attacks is seen as a practical and generous contribution. - The extensible honeypot framework covering SIP, SSH, RDP, SMB, and many other protocols is praised as a solid piece of infrastructure. **The pushback** - The title's framing — implying the named organizations themselves attacked the author — is seen as misleading and potentially legally problematic, since it was compromised devices on their networks, not the organizations themselves. - Suspicion that the blog post was AI-written drew pointed criticism, even after the author clarified AI was only used for proofreading. **By community** - hackernews (mixed): Mostly positive toward the research and free tooling, but a vocal minority questioned the sensationalist title and AI-assisted writing, prompting the author to defend both choices directly in the thread. **Hottest debate:** Whether using AI to proofread/edit a blog post constitutes 'writing it with an LLM' and undermines the author's credibility. **Open questions** - If a compromised device inside Citigroup or Lockheed Martin is being used for low-value SIP fraud, could the same malware simultaneously be exfiltrating sensitive data from those networks? - How quickly do the named institutions typically detect and remediate compromised devices once notified? **Highlights** > Author here (I run the honeypot). Since "coordinated attack" will raise eyebrows: the named organizations didn't coordinate anything, but malware running on their networks did. Each organization has a compromised device somewhere on its network, a laptop or a VoIP phone or an appliance, that got recruited into a botnet. The coordination is the botnet's command-and-control (C2). Dozens of these machines, across unrelated networks, hit the same target phone number inside the same 27-hour window and spoofed the same small set of fake caller IDs. Independent infections don't pick the same disguises and target by chance. The part I found most interesting: the operator deliberately routes through institutional IP space (a defense contractor, banks, two US state governments, a police force) precisely because those ranges have clean reputations. Datacenter and VPS IPs get fraud-scored to death; nobody blocklists Lockheed Martin's netblock. A compromised box inside a trusted network is worth more to them than a rented VPS. Something else I keep wondering about: a foothold inside Citigroup or Lockheed is a goldmine, yet here it is being spent hunting for SIP relays. International Revenue Share Fraud is lucrative, but it feels like a modest use of that access. The SIP scanning may just be the part I can see from outside; the same malware could easily be after the data on those networks too. The honeypot presents as an open SIP relay but answers the calls locally, so it logs what the attackers were trying to do without being the vulnerable PBX they were hoping to find. It has recorded ~11.5M protocol attempts across many protocols, not just SIP. I also put the data behind a free, no-key API so anyone can check their own space: curl 'https://api.knock-knock.net/check-asn?asn=' It returns the listed IPs in your network with a per-protocol breakdown. Code is open under the MIT license. See https://github.com/djkurlander/knock-knock. Check out the honeypot dashboard at https://knock-knock.net. Blocklists, since folks always ask: https://knock-knock.net/blocklist Would appreciate any questions or suggestions. Thanks! > — [djkurlander on hackernews · 3 comments](https://news.ycombinator.com/item?id=49183965) > "Coordinated attack" might raise more than eyebrows with the legal departments of the companies you've called out. >Over the next 27 hours, in four distinct waves, all of them tried to use my VoIP (SIP) server to place phone calls on my dime. As you've clarified in your comment here the companies did not do this. Compromised machines on their networks, controlled by third parties did it. > — [saaaaaam on hackernews · 1 comments](https://news.ycombinator.com/item?id=49184447) > A question: why are you writing this with an LLM? Can you not write with your own words, at least on HN? > — [Tiberium on hackernews · 1 comments](https://news.ycombinator.com/item?id=49184393) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49183953) · 49 points · 20 comments ## Similar posts on daily.dev - [Russians posing as Signal support to launch phishing raids](https://daily.dev/posts/russians-posing-as-signal-support-to-launch-phishing-raids-numtsppyp) · The Register · 0 upvotes · 0 comments - [Harvesting SSH Credentials: Insights from my Honeypot Network](https://daily.dev/posts/harvesting-ssh-credentials-insights-from-my-honeypot-network-syg9m3mdq) · Hacker News · 0 upvotes · 0 comments - [You should probably check on your smart appliances](https://daily.dev/posts/you-should-probably-check-on-your-smart-appliances-yoougpggi) · Lobsters · 0 upvotes · 0 comments - [Response to CISA Advisory \(AA25-343A\): Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure](https://daily.dev/posts/response-to-cisa-advisory-aa25-343a-pro-russia-hacktivists-conduct-opportunistic-attacks-against--etypghjmt) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/citigroup-idaho-and-build-a-bear-launched-a-coordinated-attack-on-me-k9b5p9j26) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Citigroup, Idaho, and Build-a-Bear Launched a Coordinated Attack on Me","url":"https://daily.dev/posts/citigroup-idaho-and-build-a-bear-launched-a-coordinated-attack-on-me-k9b5p9j26","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/citigroup-idaho-and-build-a-bear-launched-a-coordinated-attack-on-me-k9b5p9j26"},"datePublished":"2026-08-05T15:38:32.873Z","dateModified":"2026-08-05T16:15:19.461Z","description":"A VoIP honeypot operator discovered that machines from Citigroup, the State of Idaho, Build-A-Bear, Lockheed Martin, and dozens of other major organizations...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ab0f3b5e0456f3cf1a63da825cafae22?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ab0f3b5e0456f3cf1a63da825cafae22?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/citigroup-idaho-and-build-a-bear-launched-a-coordinated-attack-on-me-k9b5p9j26","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Citigroup, Idaho, and Build-a-Bear Launched a Coordinated Attack on Me"}]} ```