2010-11-15
Another SIP scan and traffic flood going ...
Another SIP scan and traffic flood going on, this time from 84.124.101.65. It started like all the others:[2010-11-14 07:05:40] NOTICE[6576] chan_sip.c: Registration from '"728107069"<sip:728107069@mm.nn.oo.pp>' failed for '84.124.101.65' - No matching peer found [2010-11-14 07:05:40] NOTICE[6576] chan_sip.c: Registration from '"3220398202"<sip:3220398202@mm.nn.oo.pp>' failed for '84.124.101.65' - No matching peer found [2010-11-14 07:05:47] NOTICE[6576] chan_sip.c: Registration from '"728107069" <sip:728107069@mm.nn.oo.pp>' failed for '84.124.101.65' - No matching peer found [2010-11-14 07:06:13] NOTICE[6576] chan_sip.c: Registration from '"728107069" <sip:728107069@mm.nn.oo.pp>' failed for '84.124.101.65' - No matching peer found [2010-11-14 07:06:13] NOTICE[6576] chan_sip.c: Registration from '"728107069" <sip:728107069@mm.nn.oo.pp>' failed for '84.124.101.65' - No matching peer found [2010-11-14 07:06:13] NOTICE[6576] chan_sip.c: Registration from '"728107069" <sip:728107069@mm.nn.oo.pp>' failed for '84.124.101.65' - No matching peer found [2010-11-14 07:06:13] NOTICE[6576] chan_sip.c: Registration from '"728107069" <sip:728107069@mm.nn.oo.pp>' failed for '84.124.101.65' - No matching peer found [2010-11-14 07:06:13] NOTICE[6576] chan_sip.c: Registration from '"728107069" <sip:728107069@mm.nn.oo.pp>' failed for '84.124.101.65' - No matching peer found [2010-11-14 07:06:13] NOTICE[6576] chan_sip.c: Registration from '"728107069" <sip:728107069@mm.nn.oo.pp>' failed for '84.124.101.65' - No matching peer foundAnd fail2ban picked it up soon. But it is still active, causing delays for me.
SIP packet:Via: SIP/2.0/UDP 192.168.130.65:5070;branch=z9hG4bK-3016029746;rport Transport: UDP Sent-by Address: 192.168.130.65 Sent-by port: 5070 Branch: z9hG4bK-3016029746 RPort: rport Content-Length: 0 From: "728107069" <sip:728107069@mm.nn.oo.pp> SIP Display info: "728107069" SIP from address: sip:728107069@mm.nn.oo.pp Accept: application/sdp User-Agent: friendly-scanner To: "728107069" <sip:728107069@mm.nn.oo.pp> SIP Display info: "728107069" SIP to address: sip:728107069@mm.nn.oo.pp Contact: sip:123@84.124.101.65:42529 Contact Binding: sip:123@84.124.101.65:42529 URI: sip:123@84.124.101.65:42529\r SIP contact address: sip:123@84.124.101.65:42529\r CSeq: 1 REGISTER Sequence Number: 1 Method: REGISTER Call-ID: 3948668237 Max-Forwards: 70