captcha.pbx.io

Early-media SIP screening

CAPTCHA Gateway

A SIP call-screening service that challenges suspicious callers with a short IVR code before your SBC sends them to the real destination.

See the call flow Deployment notes

What it is for

Stop automated call attempts before they consume downstream routes.

CAPTCHA Gateway sits in front of a PBX, PSTN trunk, or high-risk destination as the first route attempt from your SBC. Humans hear a short prompt and enter the spoken digits. Bots and scanners usually time out or send the wrong DTMF.

How it works

The gateway never answers the call.

The whole challenge happens in early media. That keeps the CAPTCHA leg disposable and lets the SBC decide what to do next.

01

SBC sends INVITE

Suspicious traffic is routed to the CAPTCHA gateway first.

02

Gateway sends 183

FreeSWITCH provides SDP so the caller hears the IVR prompt as early media.

03

Caller enters digits

A random code is spoken and RFC4733 DTMF is collected.

04

SBC acts on final code

503 means route to the real destination. 603 means block.

Caller
Customer SBC
CAPTCHA Gateway
FreeSWITCH MRF
INVITE
183 + SDP
Prompt + DTMF
503 pass or 603 fail

Where it helps

Designed for traffic that is too risky to pass straight through.

Robocall mitigation

Challenge calls that match suspicious source, volume, ANI, or route patterns.

TDoS protection

Slow down automated floods before they reach queues, agents, or emergency paths.

High-risk destinations

Screen expensive international or premium routes without changing the destination PBX.

Neighbor spoofing

Challenge calls that mimic local numbering patterns or fail reputation checks.

Operations

Built to be simple to operate from the SBC outward.

The gateway keeps call state small, logs every call by Call-ID, and exposes local health, metrics, and recent-call endpoints for monitoring.

SIP ingress UDP/TCP 5060
Media profile FreeSWITCH drachtio_mrf
Health check GET /healthz
Metrics Prometheus text format
Logging Structured JSON with Call-ID

Deploy

Route suspicious calls here first.

Configure the SBC with CAPTCHA Gateway as the first route attempt. Advance on 503, stop on 603, and send passed calls to the normal destination route.

challenge routesip:captcha.pbx.io:5060
pass response503 Service Unavailable
fail response603 Decline
real routePSTN / PBX destination