<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body ><div><div></div><div>Fail2ban works well otherwise you can write your own script im bash or perl to block them in iptables</div><div><br></div><div><br></div><div><div style="font-size:75%">Regards</div><div style="font-size:75%">Andrew Colin-mobile</div><div style="font-size:75%">Vsave(PTY)Ltd</div><div style="font-size:75%"><br></div><div style="font-size:75%"></div></div></div><div><div style="font-size:75%"></div></div><br><br>-------- Original message --------<br>From: Jerry Geis <geisj@pagestation.com> <br>Date:18/01/2014 10:59 PM (GMT+02:00) <br>To: asterisk-users@lists.digium.com <br>Subject: [asterisk-users] stopping unwanted attempts <br><br><div dir="ltr">I see MANY of these in my log files:<div><br></div><div><div><br></div><div>[Jan 15 03:06:12] NOTICE[14129] chan_sip.c: Registration from '"202" <sip:202@X:5060>' failed for '<a href="http://37.8.12.147:26832">37.8.12.147:26832</a>' - Wrong password</div>
<div>[Jan 15 03:06:19] NOTICE[14129] chan_sip.c: Registration from '"5001" <sip:5001@X:5060>' failed for '<a href="http://37.8.12.147:21268">37.8.12.147:21268</a>' - Wrong password</div><div>
[Jan 15 03:06:23] NOTICE[14129] chan_sip.c: Registration from '"30" <sip:30@X:5060>' failed for '<a href="http://37.8.12.147:21270">37.8.12.147:21270</a>' - Wrong password</div><div>[Jan 15 03:06:48] NOTICE[14129] chan_sip.c: Registration from '"70" <sip:70@X:5060>' failed for '<a href="http://37.8.12.147:21328">37.8.12.147:21328</a>' - Wrong password</div>
<div>[Jan 15 03:06:50] NOTICE[14129][C-00000085] chan_sip.c: Call from '' (<a href="http://8.33.7.110:5103">8.33.7.110:5103</a>) to extension '889011972592735467' rejected because extension not found in context 'default'.</div>
<div>[Jan 15 03:06:56] NOTICE[14129] chan_sip.c: Registration from '"4" <sip:4@X:5060>' failed for '<a href="http://37.8.12.147:21272">37.8.12.147:21272</a>' - Wrong password</div><div>[Jan 15 03:07:11] NOTICE[14129] chan_sip.c: Registration from '"12001" <sip:12001@X:5060>' failed for '<a href="http://37.8.12.147:5060">37.8.12.147:5060</a>' - Wrong password</div>
<div>[Jan 15 03:34:02] NOTICE[14129][C-00000086] chan_sip.c: Call from '' (<a href="http://172.246.236.90:5078">172.246.236.90:5078</a>) to extension '8889011972595301123' rejected because extension not found in context 'default'.</div>
<div><br></div></div><div>What is the "correct" way to block these idiots so they</div><div>don't even get this far.</div><div><br></div><div>Thanks,</div><div><br></div><div>Jerry</div><div><br></div></div>
</body>