[asterisk-users] Being attacked by an Amazon EC2 ...

[Zeeshan Zakaria]

Its a good idea tos setup Fail2ban, instructions for which are on
voip-info.org. It at least blocks such IP addresses, hopefully prompting the
attackers to move their attack somewhere else and leave you alone.

Another good idea is to lookup in whois database this IP address and see if
you can find contact info for the person responsible for this IP address.
Then contact them and let them know about this incident.

You can also try to ask your ISP if they can block it on their end.

Zeeshan A Zakaria

--
Sent from my Android phone with K-9 Mail.

On 2010-04-10 5:39 PM, "Gordon Henderson"
<gordon+asterisk at drogon.net<gordon%2Basterisk at drogon.net>>
wrote:


Just a "heads-up" ... my home asterisk server is being flooded by someone
from IP 184.73.17.150 which is an Amazon EC2 instance by the looks of it -
they're trying to send SIP subscribes to one account - and they're
flooding the requests in - it's averaging some 600Kbits/sec of incoming
UDP data or about 200 a second )-:

This is much worse than anything else I've seen.

Gordon

--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
              http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
  http://lists.digium.com/mailman/listinfo/asterisk-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.digium.com/pipermail/asterisk-users/attachments/20100410/c7825440/attachment.htm