Docs / Honeypot Lookup API / VICIdial install
Honeypot protection install for VICIdial
The dial-time check for VICIdial / ViciBox: one command installs the script with your key, two lines in the dialplan stop known honeypots before the carrier Dial(). The check fails open — if the lookup is slow, unreachable, or the key is wrong, the call still goes out.
You need a Honeypot API key from app.amdy.io → Honeypot protection. Run the install as root on every dialer server that places calls, not just the web front end. ViciBox 7 and newer (Python 3.4+) with no extra modules.
1. Install — one command
Paste your key over PASTE_YOUR_HONEYPOT_API_KEY and run the whole thing as one line. It downloads the AGI, makes it executable, and writes the key to a file only root can read:
curl -fsSL https://download.amdy.io/hp-check.agi -o /var/lib/asterisk/agi-bin/hp-check.agi && chmod 755 /var/lib/asterisk/agi-bin/hp-check.agi && mkdir -p /etc/amdy && echo 'PASTE_YOUR_HONEYPOT_API_KEY' > /etc/amdy/hp-key && chmod 600 /etc/amdy/hp-key
2. Modify the dialplan
On ViciBox, carrier dialplan entries live in /etc/asterisk/extensions.conf (or in the entry your carrier uses under Admin → Carriers → dialplan entry). Find the pattern your campaigns dial that ends in Dial(...) — on stock ViciBox that is _91NXXNXXXXXX (9 + 1 + number). Add the AGI check and the GotoIf before the Dial, and the hp_block label after it:
Before:
exten => _91NXXNXXXXXX,1,AGI(agi://127.0.0.1:4577/call_log)
exten => _91NXXNXXXXXX,n,Dial(${TESTSIPTRUNK}/${EXTEN:1},,tTo)
exten => _91NXXNXXXXXX,n,Hangup()After:
exten => _91NXXNXXXXXX,1,AGI(agi://127.0.0.1:4577/call_log)
exten => _91NXXNXXXXXX,n,AGI(hp-check.agi,${EXTEN})
exten => _91NXXNXXXXXX,n,GotoIf($["${HONEYPOT}" = "YES"]?hp_block)
exten => _91NXXNXXXXXX,n,Dial(${TESTSIPTRUNK}/${EXTEN:1},,tTo)
exten => _91NXXNXXXXXX,n,Hangup()
exten => _91NXXNXXXXXX,n(hp_block),NoOp(honeypot suppressed: ${HONEYPOT_PHONE})
exten => _91NXXNXXXXXX,n,Hangup(21)Then reload the dialplan:
asterisk -rx "dialplan reload"
If your install dials a different pattern (plain _1NXXNXXXXXX, or a carrier prefix), put the same three additions in that entry instead — the AGI line, the GotoIf line, and the hp_block label with Hangup(21) (call rejected). The number can arrive in any format: 9+1+number, 1+number, 10 digits, or formatted — it is checked as the same 10 digits AMDY stores. Only exception: a dial prefix stuck directly in front of the 10 digits without the 1 is not guessed; strip it with ${EXTEN:1}.
3. Verify
- The dialplan took: asterisk -rx "dialplan show _91NXXNXXXXXX@default" lists the AGI and GotoIf lines.
- The lookup runs: turn on CLI logging with asterisk -rx "core set verbose 3", place a test call, and watch the console. A blocked number prints honeypot suppressed.
- The key works: HONEYPOT_REASON is empty on a normal check. no_key means /etc/amdy/hp-key is missing; http_401 means the key is wrong; http_403 means the subscription is not active — tell us and keep dialing, the check fails open.
What the script sets
| Variable | Values |
|---|---|
| HONEYPOT | YES | NO | UNKNOWN — branch only on YES; anything else dials |
| HONEYPOT_PHONE | the 10-digit number that was checked |
| HONEYPOT_DETECTIONS | how many times AMDY saw this number answer as a honeypot |
| HONEYPOT_REASON | why it is UNKNOWN: no_key, not_us_number, timeout, http_401, http_403, … |
Optional settings
Create /etc/amdy/hp.conf (KEY=VALUE per line) only if you need to change a default:
HP_TIMEOUT=2 # seconds; the check never holds a call longer than this HP_TLS_VERIFY=0 # only on an old box whose certificate bundle cannot verify the API HP_API_KEY=... # instead of /etc/amdy/hp-key
Scrubbing is cheaper than checking
The dial-time check adds a round trip in front of every dial (normally well under 100 ms). Scrubbing the list before you load it, or scrubbing loaded leads on a cron, costs no dial-time latency at all — most rooms run one of those as the primary defense and this as the backstop: