#!/usr/bin/env python3
# spoofing_monitor.py
import os
from datetime import datetime

LOG_FILE = "call_log.txt"

def log_call(phone_number, call_type="unknown"):
    timestamp = datetime.now().isoformat()
    with open(LOG_FILE, "a") as f:
        f.write(f"{timestamp} | {call_type} | {phone_number}\n")

if __name__ == "__main__":
    import sys
    if len(sys.argv) > 1:
        log_call(sys.argv[1], sys.argv[2] if len(sys.argv) > 2 else "incoming")

from phonenumbers import carrier, geocoder, number_type

phone_number = "+15551234567"

# Get carrier information
carrier_name = carrier.name_for_number(phone_number, "en")
print(f"Carrier: {carrier_name}")

# Get number type
num_type = number_type(phone_number)
print(f"Type: {num_type}")  # 0=fixed, 1=mobile, 2=FIXED_LINE_OR_MOBILE, etc.

# Get geographic location
location = geocoder.description_for_number(phone_number, "en")
print(f"Location: {location}")

# Simple CDR analyzer to flag suspicious patterns
def analyze_cdr(cdr_data):
    suspicious = []
    for call in cdr_data:
        # Flag calls to premium rate numbers
        if call.get("destination", "").startswith("1-900"):
            suspicious.append(f"Premium rate call: {call}")

        # Flag very short calls (potential toll fraud)
        if call.get("duration", 999) < 2 and call.get("direction") == "outbound":
            suspicious.append(f"Short duration call: {call}")

    return suspicious

import hmac
import hashlib
import base64

def verify_call_signature(timestamp, caller_number, signature, shared_secret):
    """Verify STIR/SHAKEN-like signature"""
    message = f"{timestamp}{caller_number}"
    expected = base64.b64encode(
        hmac.new(
            shared_secret.encode(),
            message.encode(),
            hashlib.sha256
        ).digest()
    ).decode()
    return hmac.compare_digest(expected, signature)

#!/usr/bin/env python3
# CDR analysis for spoofing detection

import csv
from datetime import datetime
from collections import defaultdict

def analyze_cdr_for_spoofing(cdr_file):
    """
    Analyze call detail records for spoofing patterns
    CDR format: timestamp, called_number, calling_number, duration, status
    """

    calling_numbers = defaultdict(list)
    suspicious_patterns = []

    with open(cdr_file, 'r') as f:
        reader = csv.DictReader(f)
        for row in reader:
            calling_num = row['calling_number']
            timestamp = datetime.fromisoformat(row['timestamp'])

            calling_numbers[calling_num].append({
                'time': timestamp,
                'duration': int(row['duration']),
                'status': row['status']
            })

    # Pattern 1: Calls from your own number
    if '+1555' + '1234567' in calling_numbers:  # Your number
        suspicious_patterns.append({
            'type': 'Self-call',
            'severity': 'Critical',
            'explanation': 'Calls appearing from your own number'
        })

    # Pattern 2: Geographic impossibilities
    for number, calls in calling_numbers.items():
        for i in range(len(calls) - 1):
            call1 = calls[i]
            call2 = calls[i + 1]

            # Two calls from same number with impossible location distance
            time_diff = (call2['time'] - call1['time']).total_seconds() / 60
            if time_diff < 60:  # Less than 60 minutes
                suspicious_patterns.append({
                    'type': 'Geographic_Impossible',
                    'number': number,
                    'calls': [call1['time'], call2['time']],
                    'explanation': 'Multiple calls in timeframe requiring impossible travel'
                })

    # Pattern 3: Premium rate calls to toll fraud numbers
    premium_destinations = [
        '1900',  # 900 numbers (toll fraud)
        '1976',  # 976 numbers (pay-per-call)
        '1-809', # Caribbean number mills
    ]

    for number, calls in calling_numbers.items():
        for call in calls:
            for premium in premium_destinations:
                if str(call['time']).startswith(premium):
                    suspicious_patterns.append({
                        'type': 'Toll_Fraud',
                        'number': number,
                        'destination': premium,
                        'severity': 'High',
                        'cost_risk': 'High'
                    })

    # Pattern 4: Very short call durations (potential hangup testing)
    for number, calls in calling_numbers.items():
        short_calls = [c for c in calls if c['duration'] < 2]
        if len(short_calls) > 5:
            suspicious_patterns.append({
                'type': 'Hangup_Testing',
                'number': number,
                'short_calls': len(short_calls),
                'explanation': 'Multiple failed/immediate hangup calls (number validation)'
            })

    return suspicious_patterns

# Usage
suspicious = analyze_cdr_for_spoofing('my_cdr.csv')
for pattern in suspicious:
    print(f"Alert: {pattern['type']} - {pattern['explanation']}")

# Anti-spoofing verification system

import hashlib
import secrets
from datetime import datetime, timedelta

class PhoneVerificationSystem:
    def __init__(self):
        self.verification_attempts = {}
        self.verified_numbers = set()

    def send_verification_code(self, phone_number):
        """
        Send verification code with anti-spoofing measures
        """

        # Check for excessive attempts (sign of attack)
        if phone_number in self.verification_attempts:
            attempts = self.verification_attempts[phone_number]
            if len(attempts) > 5:
                recent = [t for t in attempts if t > datetime.now() - timedelta(hours=1)]
                if len(recent) > 3:
                    raise Exception("Too many verification attempts - account locked")

        # Generate code
        code = secrets.randbelow(1000000)  # 6-digit code
        code_str = f"{code:06d}"

        # Send via SMS
        send_sms(phone_number, f"Your verification code is: {code_str}")

        # Record attempt
        if phone_number not in self.verification_attempts:
            self.verification_attempts[phone_number] = []
        self.verification_attempts[phone_number].append(datetime.now())

        # Store for verification (hashed for security)
        stored_hash = hashlib.sha256(code_str.encode()).hexdigest()
        self.pending_verifications[phone_number] = {
            'code_hash': stored_hash,
            'timestamp': datetime.now(),
            'expires': datetime.now() + timedelta(minutes=10)
        }

    def verify_code(self, phone_number, provided_code):
        """
        Verify the code with anti-spoofing checks
        """

        if phone_number not in self.pending_verifications:
            raise Exception("No pending verification")

        record = self.pending_verifications[phone_number]

        # Check expiration
        if datetime.now() > record['expires']:
            raise Exception("Code expired")

        # Check code (hash comparison to avoid timing attacks)
        provided_hash = hashlib.sha256(provided_code.encode()).hexdigest()
        if secrets.compare_digest(provided_hash, record['code_hash']):
            # Verification successful
            self.verified_numbers.add(phone_number)
            del self.pending_verifications[phone_number]
            return True
        else:
            raise Exception("Invalid code")