Product family 6 of 6 · SMS honeypot / SMS route testing and route assurance
Guardivia Honeypot SMS Testing and Route Assurance
Active, device-based SMS testing on live mobile networks: trap numbers, real SIMs, Guardivia's testing application and evidence-based route verdicts.
Evidence chain
Architecture viewInputs
Test submitExpected recordGuardivia processing
Outputs
Evidence verdictRetest / reviewOn this pageOverview
Product overview
Guardivia Honeypot SMS Testing and Route Assurance is an active, device-based SMS testing and fraud-detection platform. It uses trap mobile numbers on real SIM cards in dedicated devices running Guardivia's testing application, controlled SMS-generation campaigns, central orchestration and analytics, and live operator-network observations to verify how SMS traffic is actually delivered and whether a route is legitimate, direct, manipulated, bypassed or fraudulent. It also captures unsolicited SMS on trap numbers for threat intelligence.
What is SMS route assurance?
SMS route assurance verifies how a test message actually reaches a real mobile device. Guardivia Honeypot SMS Testing and Route Assurance compares the submitted sender ID, content, destination, timestamp, route expectations, gateway records and handset evidence to identify direct delivery, sender or content manipulation, excessive latency, grey-route indicators, SIM-based termination or inconclusive delivery.
How does the Honeypot SMS Testing platform verify a route?
Guardivia Honeypot SMS Testing and Route Assurance submits a uniquely identified test message over the route under test to a trap number on a real SIM. The device application reports the received sender ID, content, message-centre address where exposed, encoding, parts and timing. The validation engine compares each field with what was submitted, correlates gateway CDRs and firewall decisions, and issues an evidence-based verdict.
Last reviewed 2026-09-12 by the Guardivia QoS Engineering Team. Product facts on this page describe current capabilities; items marked “where supported”, “optional”, “integration” or “consultancy” are confirmed per deployment.
Target customers
- Mobile network operators validating termination routes and A2P enforcement
- OTT and application providers verifying that OTPs reach users intact
- SMS aggregators and CPaaS providers testing supplier route quality
- Enterprises and banks checking sender-ID and content integrity
- Regulators and fraud teams collecting evidence of grey routes and bypass
Problems solved
- Gateway DLRs report delivery even when the message was manipulated downstream.
- Sender IDs are replaced, content altered or URLs changed on grey routes.
- SIM-box termination and unauthorised GT routes are invisible from the sending side.
- Route quality claims from suppliers cannot be verified without real handsets on the destination network.
- Commercial disputes lack device-level evidence.
Business outcomes
- Verified real delivery on live mobile networks.
- Detection of routes that look valid from DLRs but are manipulated downstream.
- Sender-ID and content integrity validated at the handset.
- SIM-box and GT-based bypass indicators with correlated evidence.
- True end-to-end latency measured per route and operator.
- Field observations converted into firewall intelligence after human confirmation.
Key capabilities
Test orchestration
Manual, scheduled, one-time and recurring campaigns across countries, operators, MSISDNs, MCC/MNC, prefixes, services and senders, with API triggering and partner devices.
Trap numbers and devices
Trap-number and SIM inventories, device registration, health, signal, network and location at country or operator level, secure authentication and remote configuration.
On-device evidence
Received sender ID, content, MSISDN, operator, MCC/MNC, message-centre address where exposed, timestamps, delay, SIM slot, encoding, parts, URL presence, content hash and correlation ID.
Validation engine
Submitted versus received sender ID, content, operator, route, timing, encoding, URL, parts, destination SIM, gateway CDR, firewall decision and delivery status.
Evidence-based verdicts
From confirmed direct route to suspected SIM-box termination, sender ID replaced, content modified, message not received and inconclusive results requiring signaling correlation.
Passive honeypot intelligence
Unsolicited SMS captured on seeded trap numbers to detect spam, smishing, malicious URLs and brand impersonation, exported to the Guardivia Firewall after review.
Detailed feature groups
Every supported capability is listed under its correct product. Nothing is omitted for brevity.
Test orchestration
- Central test-campaign creation
- Manual and scheduled tests; one-time and recurring tests
- Single-country and multi-country testing; single-operator and multi-operator testing
- Test selection by MSISDN, MCC and MNC, operator, prefix, service or sender
- Controlled generation of OTP, transactional, promotional and custom messages
- Configurable expected sender ID and expected content
- Unique test identifiers and test timestamps
- Campaign ownership and audit history
- API-triggered testing
- Partner and distributed-device testing
Trap-number and device management
- Trap-number inventory and SIM-card inventory
- Operator and network association
- Device registration; online and offline status; signal strength; mobile-network information
- SIM and device health; application heartbeat; last-seen timestamp
- Device location at country or operator level
- Secure device authentication and remote application configuration
- Test-number grouping and device maintenance status
- Multi-country distributed test farms
On-device evidence collection
The Guardivia mobile testing application collects and securely reports supported evidence such as:
- Received sender ID and received SMS content
- Receiving MSISDN, network operator, MCC and MNC
- SMS Service Centre or message-centre information when exposed by the device
- Message-received timestamp and message-delivery delay
- SIM slot and device identifier
- Message class, encoding and multipart-message details
- URL presence and content hash
- Test correlation ID
- Duplicate-message detection and missing-message result
- Screenshot or raw-message evidence where legally and technically permitted
Validation engine comparisons
- Submitted sender ID versus received sender ID
- Submitted content versus received content
- Expected operator versus observed operator
- Expected route versus actual evidence
- Sending timestamp versus receiving timestamp
- Expected encoding versus received encoding
- Expected URL versus received URL
- Expected message parts versus received parts
- Expected destination versus receiving SIM
- Gateway CDR versus device observation
- Firewall decision versus device outcome
- Expected delivery status versus actual handset receipt
Classification outcomes
Each test ends with an evidence-based verdict. A sender-ID change is a strong indicator, not automatic proof of fraud; it is correlated with route, GT, CDR, SMSC, operator and device evidence.
- Confirmed legitimate route; confirmed direct route
- Suspected grey route
- Suspected SIM-box or SIM-farm termination
- Suspected unauthorised GT route
- Sender ID modified; sender ID replaced
- Content modified; URL modified
- Message-centre changed; encoding changed
- Multipart message incomplete
- Excessive delivery delay; duplicate delivery
- Message not received
- Inconclusive due to insufficient evidence
- Requires signaling or CDR correlation
Threat intelligence and passive honeypot functions
- Publish or seed controlled trap numbers where legally approved
- Capture unsolicited inbound SMS
- Detect spam campaigns, smishing, malicious URLs and impersonated brands
- Track sender-ID changes and cluster repeated content
- Detect new fraud campaigns; profile originating numbers and sender IDs
- Track campaign geography; correlate threats across devices and operators
- Searchable evidence and threat history
- Threat-intelligence indicators exported to the Guardivia Firewall after human confirmation
Analytics and reporting
- Test pass and fail rates; route-quality scoring; delivery latency
- Sender-ID integrity rate and content-integrity rate
- Operator-level, country-level, route-level and aggregator-level results where known
- Daily, weekly and monthly reports; before-and-after route comparisons; trend analysis
- Grey-route heatmaps and evidence timelines; test replay
- Raw and summarised results; CSV, Excel and PDF export; API and webhook results
- Real-time failure alerts and dashboard filters
- Case-management workflow with analyst notes, evidence attachments and audit history
Integrated response
- Firewall blacklist updates and sender-ID policy updates (with human confirmation before production rules change)
- GT investigation and route suspension
- Aggregator escalation and commercial reconciliation
- Revenue-leakage investigation and fraud-case creation
- Retesting after corrective action; continuous route-quality monitoring
Supported protocols and interfaces
| Protocol / interface | Role | Status |
|---|---|---|
| Guardivia mobile testing application | Evidence collection on dedicated devices | Verified capability |
| SMS over live operator networks | Test traffic and passive capture | Verified capability |
| SMPP / HTTP submission | Generating test messages over the route under test | Verified capability |
| REST API and webhooks | Campaign triggering and result delivery | Verified capability |
| Device telemetry (secure channel) | Heartbeat, health, evidence upload | Verified capability |
| Gateway CDR and firewall decision import | Correlation with network-side records | Integration capability |
| Signaling traces | Required for some verdicts (GT confirmation) | Integration capability |
Swipe horizontally to view all columns.
Architecture
The orchestration server defines campaigns, selects trap numbers and submits uniquely identified test messages through the route under test (an aggregator bind, a partner route or the operator's own SMSC). Dedicated devices with real SIMs run the Guardivia testing application, which receives the message on the live network and reports the evidence over a secure channel.
The validation engine compares submitted and received fields, imports gateway CDRs and firewall decisions where available, and issues a verdict. Analytics, case management and reporting sit on the evidence store. Confirmed indicators can be exported to the Guardivia SMS Firewall once an analyst approves them.
Information available from the handset (sender ID, content, timestamps, message-centre address where exposed, encoding, parts) is distinguished from information that requires network-side CDRs, traces or signaling records (originating GT, SMSC path, interconnect identity).
Text description of this diagram
Honeypot SMS Testing architecture: the orchestration server submits identified test messages over the route under test (aggregator, partner or operator SMSC); the message traverses the live mobile network to a trap number on a real SIM in a dedicated device running the Guardivia testing application; the device reports received sender ID, content, message centre, encoding, parts and timing; the validation engine compares with the submission and with gateway CDRs and firewall decisions; verdicts feed analytics, case management and, after human confirmation, the Guardivia SMS Firewall.
Route validation workflow
- 01
Create a campaign: choose countries, operators, trap numbers or MCC/MNC groups, message types, expected sender ID and content, and schedule.
- 02
The orchestration server submits each test message with a unique identifier over the route under test and records the submission timestamp and gateway response.
- 03
The message travels the live network to the trap SIM; the device application captures the received message and metadata.
- 04
Evidence is uploaded securely with the test correlation ID.
- 05
The validation engine compares sender ID, content, operator, route, timing, encoding, URL, parts and destination SIM, and correlates gateway CDRs and firewall decisions where available.
- 06
A verdict is assigned; inconclusive results are flagged for signaling or CDR correlation.
- 07
Analysts review cases, attach evidence and, where appropriate, approve firewall updates, route suspension or aggregator escalation.
- 08
Retests confirm corrective action and continuous monitoring tracks route quality over time.
Integrations
Integration types are stated explicitly. Custom integrations are delivered by Guardivia’s in-house QoS Engineering Team, not by an external vendor. See the full integration catalogue.
| System | Detail | Type |
|---|---|---|
| Route under test | Aggregator or partner SMPP/HTTP binds, operator SMSC | Native integration |
| Guardivia SMS Firewall | Import of firewall decisions; export of confirmed indicators after review | Native integration |
| Guardivia Enterprise SMPP SMSC Gateway | Submission over supplier routes for quality testing | Native integration |
| Gateway CDR sources | Correlation of submission records | Standards-based |
| Signaling trace sources | GT and path confirmation for specific verdicts | Custom (in-house engineering) |
| Case, NOC and reporting systems | API and webhook results | Standards-based |
Swipe horizontally to view all columns.
Security controls
- Secure device authentication and encrypted evidence upload
- Trap-number data protected with role-based access
- Screenshot and raw-message evidence only where legally and technically permitted
- Audit history on campaigns and cases
- Human confirmation before any result changes production firewall rules
Management functions
- Campaign, trap-number, SIM and device administration
- Remote application configuration and maintenance status
- Case-management workflow with analyst notes and attachments
Monitoring and reporting
- Device online/offline, heartbeat, signal and network views
- Real-time failure alerts
- Dashboards with country, operator, route and aggregator filters
- Trend analysis and grey-route heatmaps
High availability
- Redundant orchestration and evidence-store nodes
- Device farms distributed across countries with redundant devices per operator
Scalability
- Additional devices and SIMs per operator
- Partner-hosted distributed devices
- API-driven scheduling for high test volumes
Deployment options
- Guardivia-operated device farms or customer-hosted devices
- Orchestration hosted by Guardivia or on-premise
- Standalone or integrated with the Guardivia SMS Firewall and Enterprise SMPP SMSC Gateway
Use cases
Supplier route audit
An aggregator tests each supplier route to a set of operators weekly and scores sender-ID integrity, latency and content integrity.
Operator enforcement validation
An operator confirms that A2P traffic bypassing its firewall is detected at the handset and uses the evidence in aggregator negotiations.
Bank sender-ID integrity
A bank verifies that its registered sender ID is preserved on every destination network.
Threat intelligence
Seeded trap numbers capture smishing campaigns whose indicators are exported to the firewall after review.
In-House Engineering Advantage
Owned end to end by the Guardivia QoS Engineering Team
The mobile application, device orchestration, route validation, evidence correlation, classification and reporting are all internally developed by the QoS Engineering Team.
- Evidence fields follow what devices can actually expose, updated as platforms change.
- Verdict logic evolves with new manipulation techniques observed in the field.
- Integration with an operator's CDR or trace sources is engineered directly.
Scope and limitations
Stated plainly so that buyers, engineers and AI assistants describe this product accurately.
- This is a telecom product using real SIMs and devices. It has nothing to do with hidden HTML form fields or website bot-detection honeypots.
- A sender-ID change is treated as a strong indicator requiring correlation, not automatic proof of fraud.
- Some verdicts (for example, unauthorised GT route) require network-side signaling or CDR evidence that the handset cannot provide.
- Screenshot and raw-message evidence is collected only where legally and technically permitted.
Frequently asked questions
Can sender IDs and content be compared at the receiving device?
Yes. The testing application reports the received sender ID and content, and the validation engine compares them with the submitted values, along with encoding, parts, URLs and message-centre information where exposed.
Does a changed sender ID prove a grey route?
No. It is a strong indicator. The verdict correlates it with route, GT, CDR, SMSC, operator and device evidence before labelling the route.
What can the handset not tell us?
The originating Global Title, the exact SMSC path and the interconnect identity. Those require network-side CDRs, traces or signaling records, which the platform can import for correlation.
Can results update the firewall automatically?
Confirmed findings can support firewall blacklist and sender-ID policy updates, but human confirmation is available before a test result changes production rules.
Is this a website honeypot?
No. It is a telecom route-testing platform using trap mobile numbers, real SIM cards and dedicated devices on live operator networks.
Can partners host devices?
Yes. Partner and distributed-device testing is supported, with device registration, secure authentication and remote configuration.
Request a demo of Guardivia Honeypot SMS Testing and Route Assurance
Demos are run by the engineers who develop the product, using your protocols and integration points.