<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<title></title>
</head>
<body text="#000000" bgcolor="#ffffff">
On 12.10.2011 19:51, Jack Honey Pot wrote:
<blockquote
cite="mid:CACEODqW4Wm4G9PCSSTkqi367h-Dicmp-GyN-_wYhjjBSiRZVYQ@mail.gmail.com"
type="cite">Hi All,<br>
<br>
I'm not the first to try to start a VOIP blacklist but currently
working on a project for the next 12 hours, hopefully I can get it
up soon. What I intend to do is to work with a few reliable
Harvester to gather the logs. A simple script to parse it then
extract the list of attackers IP, compile them and send them out
to the list.<br>
<br>
If any of you are kind enough to zip and send me a
/var/log/asterisk/messages that contain hacker's scan &
attack, it will be helpful to my research. Do email me at <a
moz-do-not-send="true" href="mailto:jack@asteriskhoneypot.com">jack@asteriskhoneypot.com</a>
. Let me know if you are keen to be a harvester as well.Thanks.<br>
<br>
</blockquote>
<br>
For such purposes I usually use fail2ban(<cite><a class="moz-txt-link-abbreviated" href="http://www.fail2ban.org">www.fail2ban.org</a></cite>)
or SEC(<a class="moz-txt-link-freetext" href="http://simple-evcorr.sourceforge.net/">http://simple-evcorr.sourceforge.net/</a>)<br>
It simplifies whole process, what you need is just regexp to catch
failed attempts.<br>
<br>
Regards<br>
</body>
</html>