FRD-20260520-001 · AIT Pattern
Artificial inflation of traffic detected on premium destination prefix 9090* · raised by FraudMonitor 2026-05-20 11:14:02
High severity ·
412 calls placed to premium prefix 9090* in 5 minutes against baseline of 2/5min (deviation +20,580%). 18-second-bursts and answer-rate of 98% suggest revenue-share fraud. Awaiting operator decision.
Alert summary
Alert ID
FRD-20260520-001
Type
AIT Pattern (Revenue-Share Fraud)
Severity
High
Status
Open
Triggered
2026-05-20 11:14:02 +03:00
Detection rule
AIT-DEST-VOL-5M-PREMIUM
Account
17321 · Outreach-Co
Campaign
CMP-202605-00874 · Promo-Live
Destination prefix
9090* (premium-rate VAS)
Calls in window
412 (5 min)
Baseline
2 / 5 min (90-day rolling)
Deviation
+20,580%
Cost incurred
$612.40
Auto-action
Alert raised — awaiting approval (auto-block threshold not yet met)
SIEM forwarded
11:14:02.425 (sub-second)
Detection process
How this alert was generated:
- FraudMonitor watches a 5-minute rolling window per destination prefix × account.
- For each window, current count is compared to a 90-day baseline (median + 3σ).
- Prefix 9090* is on the premium-rate watchlist (additional sensitivity).
- Threshold breach (≥ 50× baseline) + premium destination → High severity.
- Alert raised in GUI, emailed to fraud-ops@, streamed to SIEM, suggested action surfaced for operator review.
Mitigation options: Block destination prefix · Suspend account · Reduce campaign CPS · Mark false positive (whitelist for 24h).
Calls behind this alert (412)
Sorted by start time · SIP / media trace retained for every call| START | CALL ID | CALLER | DESTINATION | DUR | DISP | CHG |
|---|---|---|---|---|---|---|
| 11:09:01 | CALL-20260520-110901-08741 | 8855 | 9090101 | 18s | Ans | $1.20 |
| 11:09:02 | CALL-20260520-110902-08742 | 8855 | 9090223 | 18s | Ans | $1.20 |
| 11:09:02 | CALL-20260520-110902-08743 | 8855 | 9090101 | 17s | Ans | $1.18 |
| 11:09:03 | CALL-20260520-110903-08744 | 8855 | 9090414 | 18s | Ans | $1.20 |
| 11:09:03 | CALL-20260520-110903-08745 | 8855 | 9090223 | 19s | Ans | $1.22 |
| 11:09:04 | CALL-20260520-110904-08746 | 8855 | 9090101 | 18s | Ans | $1.20 |
| 11:09:04 | CALL-20260520-110904-08747 | 8855 | 9090414 | 18s | Ans | $1.20 |
| 11:09:05 | CALL-20260520-110905-08748 | 8855 | 9090101 | 17s | Ans | $1.18 |
| 11:09:05 | CALL-20260520-110905-08749 | 8855 | 9090223 | 18s | Ans | $1.20 |
| 11:09:06 | CALL-20260520-110906-08750 | 8855 | 9090414 | 18s | Ans | $1.20 |
| 11:09:06 | CALL-20260520-110906-08751 | 8855 | 9090101 | 18s | Ans | $1.20 |
| 11:09:07 | CALL-20260520-110907-08752 | 8855 | 9090223 | 17s | Ans | $1.18 |
| 11:09:07 | CALL-20260520-110907-08753 | 8855 | 9090414 | 19s | Ans | $1.22 |
| 11:09:08 | CALL-20260520-110908-08754 | 8855 | 9090101 | 18s | Ans | $1.20 |
Showing 14 of 412 · scroll to load more · 100% same caller-id 8855, all premium destination
Cost so far $612.40 · trend +$2.40/sec
Alert evidence pack (this view + CDR export) is preserved for 7 years per retention policy.