[Spce-user] How do I block this hack attempt?

[William Hilsum]

Hi Daniel,

What I was most concerned about is that nothing is showing in the IP block list at all, so, I was a bit concerned that someone is having unlimited attempts at hacking credentials… all be it different ones each time.

Looking at that link and I’ll try to implement now.

Thanks,

William

From: Spce-user [mailto:spce-user-bounces at lists.sipwise.com] On Behalf Of Daniel Grotti
Sent: 16 August 2016 13:08
To: spce-user at lists.sipwise.com
Subject: Re: [Spce-user] How do I block this hack attempt?

Hi,
you can have a look at : https://www.linkedin.com/pulse/securing-your-ngcp-against-sip-attacks-daniel-grotti?trk=mp-reader-card
Quite old, but still valid.

In your case looks like users are trying to authenticate, failing more then 3 times, so they got banned.
I think you may find some answers in the link above.

Cheers,
Daniel
On 08/16/2016 02:04 PM, William Hilsum wrote:
I didn’t get any confirmation yesterday, so, trying to resend…

Hi,

I have just looked at the security banks section and I notice that there are no banned IPs, but, loads of entries for “random-4-digits at PBX-IP”.

For example, take a look here - http://imgur.com/a/hA9Uz

Can anyone advise on any security best practice I should set up?

Thanks,

William





_______________________________________________

Spce-user mailing list

Spce-user at lists.sipwise.com<mailto:Spce-user at lists.sipwise.com>

https://lists.sipwise.com/listinfo/spce-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sipwise.com/mailman/private/spce-user_lists.sipwise.com/attachments/20160816/514a4488/attachment.html>