[asterisk-users] Under heavy attack

dotnetdub dotnetdub at gmail.com
Sun Oct 31 04:16:35 CDT 2010


On 30 October 2010 19:28, Zeeshan Zakaria <zishanov at gmail.com> wrote:

> My main asterisk server is under unusual heavy attack, and so far Fail2Ban
> has blocked about 30 IPs, from various different countries. At this time it
> is blocking about 1 IP address every few minutes.
>
> Just wondering if anybody else is also experiencing unusually increased
> hack attempts today?
>
> Zeeshan A Zakaria
>
> --
> www.ilovetovoip.com
> www.pbxforall.com (beta)
>


Good Morning.

Certainly some kind of very slow DDOS attack.

I'm blocking at IPTABLES level.

Strange thing is even after I DROP the REGISTER attempts they keep on trying
which is unusual.

We have a number of Asterisk & Kamailio boxes on the same subnet and it's
only targeting 1 Asterisk box.

IP's so far if anyone wants to block them before they start on your SIP
device:

2010-10-30 18:20:19,023  213.6.233.51

2010-10-30 18:29:41,251  124.122.224.110

2010-10-30 18:29:53,296  41.178.183.80

2010-10-30 18:30:06,047  118.71.80.236

2010-10-30 18:35:05,356  93.181.206.84

2010-10-30 18:35:17,588  207.226.53.120

2010-10-30 18:35:19,995  151.15.169.144

2010-10-30 19:09:35,223  41.133.218.95

2010-10-30 19:10:37,108  125.165.185.126

2010-10-30 19:10:54,011  196.221.74.86

2010-10-30 19:11:06,779  58.8.51.183

2010-10-30 19:11:09,739  111.125.76.79

2010-10-30 19:12:29,671  189.224.23.133

2010-10-30 19:15:28,303  62.87.81.138

2010-10-30 19:17:44,548  118.96.68.202

2010-10-30 19:19:39,432  178.137.18.176

2010-10-30 19:20:59,923  109.197.85.84

2010-10-30 19:22:41,063  91.187.103.33

2010-10-30 19:24:57,283  79.191.64.68

2010-10-30 19:29:39,523  189.19.36.241

2010-10-30 19:33:19,096  85.97.235.244

2010-10-30 19:40:51,324  145.236.187.148

2010-10-30 19:43:02,567  196.217.233.120

2010-10-30 19:47:46,323  145.236.184.134

2010-10-30 19:54:07,564  186.89.189.218

2010-10-30 19:54:51,155  178.154.93.136

2010-10-30 20:01:32,615  187.126.9.46

2010-10-30 20:01:53,215  92.253.28.116

2010-10-30 20:02:31,448  41.218.245.63

2010-10-30 20:05:24,203  85.104.3.147

2010-10-30 20:06:40,431  93.116.63.10

2010-10-30 20:09:00,668  151.15.165.59

2010-10-30 20:09:13,907  95.132.177.3

2010-10-30 20:09:52,135  187.17.185.1

2010-10-30 20:11:46,719  88.230.199.132

2010-10-30 20:22:10,947  86.34.8.194

2010-10-30 20:23:10,176  109.96.12.119

2010-10-30 20:23:18,336  201.240.127.189

2010-10-30 20:25:56,932  92.84.117.146

2010-10-30 20:26:26,155  88.227.121.14

2010-10-30 20:37:26,400  189.7.19.95

2010-10-30 20:37:33,024  41.236.166.150

2010-10-30 20:39:26,968  118.96.218.199

2010-10-30 20:44:27,968  41.232.67.66

2010-10-30 20:48:48,715  41.189.55.21

2010-10-30 20:52:12,431  189.15.98.140

2010-10-30 20:54:51,031  189.70.167.100

2010-10-30 20:55:42,639  189.15.99.161

2010-10-30 20:56:19,243  41.189.53.202

2010-10-30 20:58:24,979  41.189.54.61

2010-10-30 20:58:49,720  79.112.136.182

2010-10-30 20:59:40,959  41.189.55.3

2010-10-30 21:06:31,700  180.214.232.20

2010-10-30 21:10:27,811  189.23.61.5

2010-10-30 21:15:42,452  118.96.106.229

2010-10-30 21:34:23,343  93.146.195.166

2010-10-30 21:42:25,575  190.172.152.53

2010-10-30 21:43:10,184  94.141.68.62

2010-10-30 23:03:41,419  78.176.225.22

2010-10-30 23:46:20,651  76.116.250.237

2010-10-30 23:49:53,023  188.52.97.82

2010-10-30 23:52:02,279  78.167.12.19

2010-10-31 00:02:12,511  200.220.209.204

2010-10-31 00:11:01,491  41.205.112.90

2010-10-31 00:13:20,399  187.74.15.7

2010-10-31 00:13:36,963  201.42.156.126

2010-10-31 00:16:00,563  41.238.170.22

2010-10-31 00:26:21,299  62.248.47.86

2010-10-31 00:34:34,524  93.116.228.188

2010-10-31 00:41:35,760  110.32.149.227

2010-10-31 00:46:44,755  81.6.90.142

2010-10-31 00:50:50,995  78.162.174.78

2010-10-31 00:58:23,220  123.23.243.19

2010-10-31 00:59:01,476  119.42.83.249

2010-10-31 01:04:01,403  112.201.240.119

2010-10-31 01:15:13,300  190.233.197.248

2010-10-31 01:18:14,979  189.110.116.97

2010-10-31 01:19:07,572  113.162.96.205

2010-10-31 01:23:30,527  178.210.133.205

2010-10-31 01:32:22,339  151.15.175.8

2010-10-31 01:51:35,576  178.53.139.232

2010-10-31 02:00:01,131  85.104.94.215

2010-10-31 02:00:02,403  123.27.9.4

2010-10-31 02:00:03,281  118.137.89.66

2010-10-31 02:00:04,184  113.170.140.8

2010-10-31 02:07:17,011  125.185.5.19

2010-10-31 02:15:02,887  123.17.204.125

2010-10-31 02:22:27,803  81.192.211.208

2010-10-31 02:25:47,031  118.96.176.53

2010-10-31 02:35:08,059  113.169.105.142

2010-10-31 02:47:15,984  222.253.242.237

2010-10-31 02:52:05,876  99.229.149.67

2010-10-31 06:25:08,147  187.74.15.7

2010-10-31 06:25:08,764  112.201.240.119

2010-10-31 06:25:09,781  93.116.228.188

2010-10-31 06:25:10,084  188.52.97.82

2010-10-31 06:25:14,303  118.137.89.66

2010-10-31 06:25:27,251  201.42.156.126

2010-10-31 06:36:19,591  188.53.35.208

2010-10-31 07:40:12,855  121.246.144.94

2010-10-31 07:41:29,783  222.124.3.13

2010-10-31 07:41:42,671  77.81.49.178

2010-10-31 07:42:41,911  119.92.232.162

2010-10-31 07:42:52,792  110.168.115.109

2010-10-31 07:44:10,831  222.253.241.210

2010-10-31 07:45:46,755  94.240.149.110

2010-10-31 07:50:09,999  178.155.54.47

2010-10-31 07:51:36,471  88.226.33.30

2010-10-31 07:52:08,684  113.172.230.103

2010-10-31 07:55:10,723  118.96.242.225

2010-10-31 07:55:33,595  109.120.46.78

2010-10-31 07:55:45,735  113.167.33.220

2010-10-31 07:57:32,575  60.220.253.149

2010-10-31 07:57:48,483  113.166.1.235

2010-10-31 07:59:16,335  113.59.222.50

2010-10-31 07:59:54,187  41.215.64.66

2010-10-31 08:04:48,071  85.106.225.138

2010-10-31 08:04:54,300  88.227.52.50

2010-10-31 08:05:56,551  193.106.220.17

2010-10-31 08:29:51,783  202.133.58.122

2010-10-31 08:33:05,652  188.38.10.102

2010-10-31 08:33:22,880  78.185.153.80

2010-10-31 08:34:08,119  41.210.27.205

2010-10-31 08:34:21,063  89.122.0.141

2010-10-31 08:36:01,300  94.255.118.14

2010-10-31 08:38:46,528  81.213.179.105



Regards
Brian





>
> --
> _____________________________________________________________________
> -- Bandwidth and Colocation Provided by http://www.api-digital.com --
> New to Asterisk? Join us for a live introductory webinar every Thurs:
>               http://www.asterisk.org/hello
>
> asterisk-users mailing list
> To UNSUBSCRIBE or update options visit:
>   http://lists.digium.com/mailman/listinfo/asterisk-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.digium.com/pipermail/asterisk-users/attachments/20101031/5fda2b0f/attachment.htm 


More information about the asterisk-users mailing list