<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Easy ...<br></div><div><br data-mce-bogus="1"></div><div>291a292,298<br>> ## filtering by UA : blacklist<br>> if(is_method("REGISTER|INVITE|OPTIONS") && ($ua =~ "friendly-scanner" || $ua =~ "sipvicious" || $ua =~ "^sipcli.+"))<br>> {<br>> xlog("L_WARN", "Request rejected, malicious UA='$ua' from IP=$si - [% logreq_init -%]\n");<br>> exit;<br>> }<br>><br></div><div><br data-mce-bogus="1"></div><div>Patch applied over the lb/kamailio.cfg.tt2 ... so create a .cusomtt.tt2<br data-mce-bogus="1"></div><div><br></div><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>De: </b>"Jose E. Vargas B." <j_e_vargas@live.com><br><b>Para: </b>spce-user@lists.sipwise.com<br><b>Enviados: </b>Jueves, 4 de Febrero 2016 18:38:25<br><b>Asunto: </b>[Spce-user] bruteforcing sip credentials attack<br></blockquote></div><div data-marker="__QUOTED_TEXT__"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;">Hello,<div class=""><br class=""><div class="">Just have a quick and probably easy question for the SP community. I am experimenting with the server and keep getting the entire day the following attack:</div><div class=""><br class=""></div><div class=""><div class=""><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(153, 18, 0); background-color: rgb(0, 0, 0);" class=""><b class="">016/02/04 19:20:16.673827 188.138.33.14:5071 -> yy.yy.yy.yy:5060</b></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 166, 178); background-color: rgb(0, 0, 0);" class=""><span style="font-variant-ligatures: no-common-ligatures; color: #999900" class=""><b class="">INVITE</b></span><span style="font-variant-ligatures: no-common-ligatures; color: #bfbfbf" class=""> </span><b class=""><a href="sip:901141445209482@xx.xx.xx.xx" class="" target="_blank">sip:901141445209482@xx.xx.xx.xx</a></b><span style="font-variant-ligatures: no-common-ligatures; color: #bfbfbf" class=""> SIP/2.0</span></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class=""><span style="font-variant-ligatures: no-common-ligatures; color: #00a500" class="">To:</span> 901141445209482<<a href="sip:901141445209482@xx.xx.xx.xx" class="" target="_blank">sip:901141445209482@xx.xx.xx.xx</a>></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class=""><span style="font-variant-ligatures: no-common-ligatures; color: #00a500" class="">From:</span> 0550<<a href="sip:0550@xx.xx.xx.xx" class="" target="_blank">sip:0550@xx.xx.xx.xx</a>>;tag=67a87716</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class=""><span style="font-variant-ligatures: no-common-ligatures; color: #00a500" class="">Via:</span> SIP/2.0/UDP 188.138.33.14:5071;branch=z9hG4bK-6f67d7e24b4ac8a25f3d76106be4cb74;rport</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(179, 42, 178); background-color: rgb(0, 0, 0);" class=""><span style="font-variant-ligatures: no-common-ligatures; color: #00a500" class="">Call-ID:</span><span style="font-variant-ligatures: no-common-ligatures; color: #bfbfbf" class=""> </span><b class="">6f67d7e24b4ac8a25f3d76106be4cb74</b></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(153, 153, 0); background-color: rgb(0, 0, 0);" class=""><span style="font-variant-ligatures: no-common-ligatures; color: #00a500" class="">CSeq:</span><span style="font-variant-ligatures: no-common-ligatures; color: #bfbfbf" class=""> 1 </span>INVITE</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class=""><span style="font-variant-ligatures: no-common-ligatures; color: #00a500" class="">Contact:</span> <<a href="sip:0550@188.138.33.14:5071" class="" target="_blank">sip:0550@188.138.33.14:5071</a>></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 165, 0); background-color: rgb(0, 0, 0);" class="">Max-Forwards:<span style="font-variant-ligatures: no-common-ligatures; color: #bfbfbf" class=""> 70</span></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class=""><span style="font-variant-ligatures: no-common-ligatures; color: #00a500" class="">Allow:</span> INVITE, ACK, CANCEL, BYE</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class=""><span style="font-variant-ligatures: no-common-ligatures; color: #00a500" class="">User-Agent:</span> sipcli/v1.8</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class=""><span style="font-variant-ligatures: no-common-ligatures; color: #00a500" class="">Content-Type:</span> application/sdp</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 165, 0); background-color: rgb(0, 0, 0);" class="">Content-Length:<span style="font-variant-ligatures: no-common-ligatures; color: #bfbfbf" class=""> 281</span></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(0, 0, 0); min-height: 13px;" class=""><br class=""></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class="">v=0</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class="">o=sipcli-Session 691746334 738426574 IN IP4 188.138.33.14</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class="">s=sipcli</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class="">c=IN IP4 188.138.33.14</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class="">t=0 0</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class="">m=audio 5073 RTP/AVP 18 0 8 101</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class="">a=fmtp:101 0-15</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class="">a=rtpmap:18 G729/8000</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class="">a=rtpmap:0 PCMU/8000</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class="">a=rtpmap:8 PCMA/8000</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class="">a=rtpmap:101 telephone-event/8000</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class="">a=ptime:20</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(191, 191, 191); background-color: rgb(0, 0, 0);" class="">a=sendrecv</div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">I guess it is a funny group/folk trying to get unauthorized access to the server by sending multiple SIP invites with different accounts and possible free phone calls ;) The problem is that SPCE won’t detect it as his attempts are spared in time. Would like to get your guidance about blocking the entire IP or domain to SCPCE server. Could you please comment on how you deal with this type of attack?</div><div class=""><br class=""></div><div class="">Jose </div></div></div><div class=""><br class=""></div><div class="">PS: </div><div class=""> BTW - making changes to config.yml (failed _auth)…) didn’t help </div><div class=""> Offending IP: 188.138.33.14</div><div class=""><br class=""></div><div class=""><br class=""></div><br>_______________________________________________<br>Spce-user mailing list<br>Spce-user@lists.sipwise.com<br>https://lists.sipwise.com/listinfo/spce-user<br></blockquote></div></div></body></html>