[asterisk-users] PBX hacked: why hundred of calls to the same number ?

[Rainer Piper]

Am 02.10.2014 um 15:40 schrieb Tzafrir Cohen:
> On Thu, Oct 02, 2014 at 07:52:34AM +0200, Rainer Piper wrote:
>
>> Is the destination Number like Country Code +972?
>>
>> +972 59 xxxxxx(x) mobile - Jawall [moving to 7-digit subscriber numbers]
>>
>> source - http://www.wtng.info/wtng-972-il.html
> That page is slightly dated. +972 59 XXXXXXX are all the numbers in the
> Palestinian Authority (there are several providers besides Jawall).
>
>> My SIP Proxy logs all the unauth. INVITEs and I found the a lot
>> calls go to the Country code +972 xxxxxxxxxxx
> As a resident of +972 (+972-4), I'll just note that those hack attempts
> are typically related to PA numbers (+972-59) as rates there are higher.
>
Hi Tzafrir,

ok, the page www.wtng.info is not really up to date.

here some logs to see the variations of the attempt  to dial over my proxy

Oct  3 11:23:06 server /sbin/kamailio[7217]: NOTICE: <script>: blocking IP 69.30.254.234 sipcli/v1.8 rm=INVITE aU=<null> rU=00972592910519  <callto:00972592910519>
Oct  3 11:42:52 server /sbin/kamailio[7218]: NOTICE: <script>: blocking IP 69.30.254.234 sipcli/v1.8 rm=INVITE aU=<null> rU=972592910519
Oct  3 11:53:15 server /sbin/kamailio[7217]: NOTICE: <script>: blocking IP 69.30.254.234 sipcli/v1.8 rm=INVITE aU=<null> rU=700972592910519
Oct  3 12:06:32 server /sbin/kamailio[7218]: NOTICE: <script>: blocking IP 69.30.254.234 sipcli/v1.8 rm=INVITE aU=<null> rU=200972592910519
Oct  3 12:20:04 server /sbin/kamailio[7217]: NOTICE: <script>: blocking IP 69.30.254.234 sipcli/v1.8 rm=INVITE aU=<null> rU=#00972592910519  <callto:00972592910519>
Oct  3 12:32:53 server /sbin/kamailio[7218]: NOTICE: <script>: blocking IP 69.30.254.234 sipcli/v1.8 rm=INVITE aU=<null> rU=*000972592910519
Oct  3 12:45:35 server /sbin/kamailio[7217]: NOTICE: <script>: blocking IP 69.30.254.234 sipcli/v1.8 rm=INVITE aU=<null> rU=*972592910519
Oct  3 12:57:42 server /sbin/kamailio[7217]: NOTICE: <script>: blocking IP 69.30.254.234 sipcli/v1.8 rm=INVITE aU=<null> rU=9999900972592910519
Oct  3 13:09:37 server /sbin/kamailio[7218]: NOTICE: <script>: blocking IP 69.30.254.234 sipcli/v1.8 rm=INVITE aU=<null> rU=7700972592910519
Oct  3 13:21:24 server /sbin/kamailio[7217]: NOTICE: <script>: blocking IP 69.30.254.234 sipcli/v1.8 rm=INVITE aU=<null> rU=66600972592910519
Oct  3 13:33:11 server /sbin/kamailio[7218]: NOTICE: <script>: blocking IP 69.30.254.234 sipcli/v1.8 rm=INVITE aU=<null> rU=555500972592910519

and the source IP

69.30.254.234

is coming from

OrgName:        WholeSale Internet, Inc.
OrgId:          WHOLE-125
Address:        324 E. 11th St.
Address:        Suite 1000
City:           Kansas City
StateProv:      MO
PostalCode:     64106
Country:        US

very strange ;-)


-- 
*Rainer Piper*
Integration engineer
Koeslinstr. 56
53123 BONN
GERMANY
Phone: +49 228 97167161 <callto:004922897167161>
P2P: sip:rainer at sip.soho-piper.de:5072 (pjsip-test)
XMPP: rainer at xmpp.soho-piper.de
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-users/attachments/20141003/88e3b8b5/attachment.html>