[asterisk-users] Brute force attacks

Thu Jul 1 16:56:06 CDT 2010

The IP 69.175.35.186 has just been banned by Fail2Ban after 293 attempts against our server.

From: asterisk-users-bounces at lists.digium.com [mailto:asterisk-users-bounces at lists.digium.com] On Behalf Of John Timms
Sent: Thursday, July 01, 2010 11:32 AM
To: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: Re: [asterisk-users] Brute force attacks

On Thu, Jul 1, 2010 at 9:16 AM, Ishfaq Malik <ish at pack-net.co.uk<mailto:ish at pack-net.co.uk>> wrote:
Hi

We've just noticed attempts (close to 200000 attempts, sequential peer numbers) at guessing peers on 2 of out servers and thought I'd share the originating IPs with the list in case anyone wants to firewall them as we have done

109.170.106.59
112.142.55.18
124.157.161.67

Ish
--
Ishfaq Malik
Software Developer
PackNet Ltd

Office:   0161 660 3062

--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
              http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
  http://lists.digium.com/mailman/listinfo/asterisk-users

We have noticed the same sort of activity on our server. The originating IP addresses attempting access were:

204.9.204.145 (hosted at U.S. Colo, I believe)
91.203.132.149 (Nephax)
130.70.157.186 (University of Louisiana)
61.160.121.46 (Chinanet)
109.170.0.10 (ReasonUP Ltd)

--
John Timms
IT Department - Gnoso Inc.
john at gnoso.com<mailto:john at gnoso.com>
--
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.digium.com/pipermail/asterisk-users/attachments/20100701/9dc9eaa1/attachment-0001.htm 