3CX license limit reached due to robocalls

[tlyoung99]

We're getting the following message:
Your 3CX license limit has been reached. This means that you cannot make any more calls at this time.
Active calls: [599,600,601,603,604]

From reviewing the activity log, this is due to robocalls that are hitting us in quick succession (5 calls within 30 seconds).
Is there anything that can be done in 3cx (such as a flood limit for calls placed from 1 number within a short period of time)? We already have our "no input timeout" set at 5 seconds. Our welcome message is about 20 seconds long so before they get disconnected due to non-response, they've already called us 5 times to put us over our limit. Going through our CDRs, there are times where as soon as a robocall gets disconnected due to non-response, another call form the same number will come in. This effectively blocks our lines to real customers for the time that they are hammering us.

I've already reached out to our trunk provider, FlowRoute. This is their response:
We unfortunately don't have means to restrict traffic across our network. The calls will only be charged if accepted on your end, so you would need to be looking at your 3CX installation for a resolution. You may be able to create some catchall inbound rule within your 3CX deployment that will divert traffic to a non-configured extension that will not accept the call, and therefore not be charged for the call completion, though you would need to review 3CX documentation and/or contact 3CX support.

Any recommendations?

 

[leejor]

I'm going to assume that they are changing their caller ID . If it remained the same, then you could use that to send the calls to a destination such as "end call". Unfortunately, if the caller ID is different, then you will have to answer the call, then force the "robot" to enter a digit, (which they can't do), before dropping the call. It means that you will still be billed for the call and it will tie up a trunk until they drop off.

 

[tlyoung99]

Yes, many different caller ids hitting us with multiple calls in quick succession.

The scenario you've outlined is exactly what we're doing and exactly what we are experiencing. I'm just surprised it isn't affecting enough other businesses to warrant a "flood block" setting in 3cx where if more than x calls from a given number within y seconds, it blocks subsequent calls from that number for some duration of time. I assume the robocallers would then just spoof different numbers as a workaround.

 

[leejor]

Robocallers use many different callers ID, including those of legitimate, working numbers. I have to assume that some CID numbers are simply created randomly, many times using a local areacode and prefix, to try to get people to answer..

 

[Michael Jennings]

Voxtelesus does offer spam scoring; I am not sure this will help you at this time as the scoring is in the sip header... We have a project that is in Alfa that will allow you to Recapta the call based on the Spam score, but the beta is not set until late October. One recommendation is that you limit your inbound call from the carrier to just under your Trunk limit. This will ensure that you have at least one open for out calling. Not all carriers do, but we offer a fail-over for inbound calling that can be forwarded to a second location like a cell for answering service if the trunk is full.