<div dir="ltr">Hi All<div><br></div><div>Had some fraud occur last night,</div><div><br></div><div>The registration happened as follows, note user 108 does not exist. but "VALIDUSER" does,</div><div><br></div><div>Jan 7 04:05:59 sip2 lb[20140]: NOTICE: <script>: New request on lb - M=REGISTER R=sip:<1.publicIPOfOurs> F=sip:108@<1.publicIPOfOurs> T=sip:108@<1.publicIPOfOurs> IP=udp:<a href="http://41.57.140.160:6180">41.57.140.160:6180</a> ID=fb17c3515b0e3437 UA='LOLO' DESTIP=<1.publicIPOfOurs>:5060<br>Jan 7 04:05:59 sip2 lb[20141]: NOTICE: <script>: New request on lb - M=REGISTER R=sip:<1.publicIPOfOurs> F=sip:108@<1.publicIPOfOurs> T=sip:108@<1.publicIPOfOurs> IP=udp:<a href="http://41.57.140.160:6180">41.57.140.160:6180</a> ID=fb17c3515b0e3437 UA='LOLO' DESTIP=<1.publicIPOfOurs>:5060<br>Jan 7 04:06:06 sip2 lb[20145]: NOTICE: <script>: New request on lb - M=REGISTER R=sip:<1.publicIPOfOurs> F=sip:<validUserOfOurs>@<1.publicIPOfOurs> T=sip:<validUserOfOurs>@<1.publicIPOfOurs> IP=udp:<a href="http://41.57.140.160:6180">41.57.140.160:6180</a> ID=8b236c12a87d4a0d UA='LOLO' DESTIP=<1.publicIPOfOurs>:5060<br></div><div><br></div><div>To me, the alarming part is, there was no brute force, it was just an immediate hack. Yet moments before, they didnt even know the right username to try. There is exists no provisioning or anything like that either, its just 2 tries on an invalid users, and then an immediate successful hit on a valid user, and 20 seconds later it starts making call attempts.</div><div><br></div><div>any advice welcome</div><div><br></div><div>Kind Regards<br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><p> </p>
<p><span style="font-size:10.0pt;color:gray"><img src="http://www.tenacit.net/googlesig/tenacit.png" width="200" height="65"></span><span lang="EN-ZA" style="font-size:10.0pt;color:gray"></span></p>
<p><span lang="EN-ZA" style="font-size:10.0pt;color:black"> </span></p>
<p><b><span lang="EN-ZA" style="font-size:12.0pt;color:#79ae52">Matthew Ogden</span></b></p>
<p><span style="font-size:10.0pt;color:gray">Management</span></p>
<p><span style="font-size:10.0pt;color:gray">TenacIT
</span></p>
<p><span style="font-size:10.0pt;color:gray"> </span></p>
<p><span style="color:gray;font-size:10pt"> </span><br></p>
<p><b><span lang="EN-ZA">Strategic IT Consulting </span></b><span lang="EN-ZA" style="font-size:12.0pt;color:#79ae52">•</span><b><span lang="EN-ZA"> Advanced Networking </span></b><span lang="EN-ZA" style="font-size:12.0pt;color:#79ae52">• </span><b><span lang="EN-ZA">Virtualisation</span></b><span lang="EN-ZA" style="font-size:12.0pt;color:#79ae52"> </span><b><span lang="EN-ZA"></span></b></p>
<p><b><span lang="EN-ZA">Custom Development </span></b><span lang="EN-ZA" style="font-size:12.0pt;color:#79ae52">•</span><b><span lang="EN-ZA"> </span></b><b><span lang="EN-ZA">Hosting </span></b><span lang="EN-ZA" style="font-size:12.0pt;color:#79ae52">•</span><b><span lang="EN-ZA"> </span></b><b><span lang="EN-ZA">Syspro Support </span></b><span lang="EN-ZA" style="font-size:12.0pt;color:#79ae52">• </span><b><span lang="EN-ZA">MS Licensing</span></b><span lang="EN-ZA" style="font-size:12.0pt;color:#79ae52"> </span><b><span lang="EN-ZA"></span></b></p>
<p><span lang="EN-ZA" style="font-size:9.0pt;color:#a6a6a6">National Tel: </span><span lang="EN-ZA" style="font-size:9.0pt;color:gray">041 10 10 100
| </span><span lang="EN-ZA" style="font-size:9.0pt;color:#a6a6a6">Cell: </span><span lang="EN-ZA" style="font-size:9.0pt;color:gray">084 205 4445 | </span><span lang="EN-ZA" style="font-size:9.0pt;color:#a6a6a6">Email: </span><a href="mailto:matthew@tenacit.net" target="_blank"><span style="font-size:9.0pt;color:gray;text-decoration:none">matthew@tenacit.net</span></a><span style="font-size:9.0pt;color:#44546a"> </span><span style="font-size:9.0pt;color:gray"></span></p>
<p><span lang="EN-ZA" style="font-size:9.0pt;color:#a6a6a6">CT Tel: </span><span lang="EN-ZA" style="font-size:9.0pt;color:gray">021 201 0333 | </span><span lang="EN-ZA" style="font-size:9.0pt;color:#a6a6a6">Skype Name: </span><span lang="EN-ZA" style="font-size:9.0pt;color:gray">matthew.ogden | </span><span lang="EN-ZA" style="font-size:9.0pt;color:#a6a6a6">Web: </span><span lang="EN-ZA" style="font-size:9.0pt;color:#bce292;text-decoration:none"><a href="http://www.tenacit.net/" target="_blank">http://www.tenacit.net</a></span></p><p> <img src="http://www.tenacit.net/googlesig/bottom.png"></p></div></div></div></div><div hspace="streak-pt-mark" style="max-height:1px"><img alt="" style="width:0px;max-height:0px;overflow:hidden" src="https://mailfoogae.appspot.com/t?sender=abWF0dGhld0BnYXBwLnRlbmFjaXQubmV0&type=zerocontent&guid=995e34eb-ea81-46dc-b705-054e9b981e5a"><font color="#ffffff" size="1">ᐧ</font></div>