A bit of a DOS perhaps

Hi there


A bit of stats;
http://www.sput.nl/asterisk/
And these are just the call attempts. There where
222357 registration attempts from 208.115.244.154.
Why would anyone want to do this?


Regards,
Rob
--
Why You Should Be More Interested in Mars Than the Olympics
http://www.huffingtonpost.com/andrew...b_1712462.html

Rob van der Putten wrote:

> A bit of stats;
> http://www.sput.nl/asterisk/
> And these are just the call attempts. There where
> 222357 registration attempts from 208.115.244.154.
> Why would anyone want to do this?

To run their "phone your Israeli relatives kiosk" at your expense?

In article <5045c3d5$0$3099$e4fe514c@dreader34.news.xs4all.nl >,
Rob van der Putten <rob@sput.nl> wrote:
>Hi there
>
>
>A bit of stats;
>http://www.sput.nl/asterisk/
>And these are just the call attempts. There where
>222357 registration attempts from 208.115.244.154.
>Why would anyone want to do this?

To steal your phone calls.

Google: sipvicious

Gordon

Hi there


Andy Burns wrote:

> To run their "phone your Israeli relatives kiosk" at your expense?

[2012-09-03 07:56:25 +0200] NOTICE[3279] chan_sip.c:
Registration from '"605" <sip:605@80.101.95.251>'
failed for '208.115.244.154:5451' -
No matching peer found
A registration doesn't work. So you try again. And again...
root@sput:/var/log/asterisk# grep Registration\ from messages.1 | grep
594 | wc -l
31099
root@sput:/var/log/asterisk# grep Registration\ from messages.1 | grep
595 | wc -l
9133
root@sput:/var/log/asterisk# grep Registration\ from messages.1 | grep
596 | wc -l
16450
root@sput:/var/log/asterisk# grep Registration\ from messages.1 | grep
597 | wc -l
19432
Etc...

At least with the call attempts, they did one try per number.


Regards,
Rob
--
Why You Should Be More Interested in Mars Than the Olympics
http://www.huffingtonpost.com/andrew...b_1712462.html

Hi there


Gordon Henderson wrote:

> To steal your phone calls.
>
> Google: sipvicious

Lots of videos.


Regards,
Rob
--
Why You Should Be More Interested in Mars Than the Olympics
http://www.huffingtonpost.com/andrew...b_1712462.html

On Tue, 04 Sep 2012 12:00:36 +0200, Rob van der Putten wrote:

> Hi there
>
>
> Andy Burns wrote:
>
>> To run their "phone your Israeli relatives kiosk" at your expense?
>
> [2012-09-03 07:56:25 +0200] NOTICE[3279] chan_sip.c:
> Registration from '"605" <sip:605@80.101.95.251>'
> failed for '208.115.244.154:5451' -
> No matching peer found
> A registration doesn't work. So you try again. And again...
> root@sput:/var/log/asterisk# grep Registration\ from messages.1 | grep
> 594 | wc -l 31099 root@sput:/var/log/asterisk# grep Registration\ from
> messages.1 | grep 595 | wc -l 9133 root@sput:/var/log/asterisk# grep
> Registration\ from messages.1 | grep 596 | wc -l 16450
> root@sput:/var/log/asterisk# grep Registration\ from messages.1 | grep
> 597 | wc -l 19432 Etc...
>
> At least with the call attempts, they did one try per number.

Fail2ban is good.



--
Use the BIG mirror service in the UK:
http://www.mirrorservice.org

*lightning protection* - a w_tom conductor

Andy Burns <usenet.aug2009@adslpipe.co.uk> wrote in <E4ydnTw1o9h5VNjNnZ2dnUVZ8iWdnZ2d@brightview.co.uk >:
> Rob van der Putten wrote:

>> A bit of stats;
>> http://www.sput.nl/asterisk/
>> And these are just the call attempts. There where
>> 222357 registration attempts from 208.115.244.154.
>> Why would anyone want to do this?

> To run their "phone your Israeli relatives kiosk" at your expense?

Parts of the middle east seem to like hard to trace and paid for by someone
else voip calls.

I amuse myself by playing random 'your call could not be completed as
dialed' recordings when you try anything in the sip guest environment of an
asterisk test server which looks like an international call. This keeps
some intruders at work for 10-20 attempts until they give up.

SIP registration attempts are handled by fail2ban.

Koos

--
Koos van den Hout, PGP keyid DSS/1024 0xF0D7C263 via keyservers
koos@kzdoos.xs4all.nl
Visit the site about books with reviews
http://idefix.net/ http://www.virtualbookcase.com/