On Wed, Nov 28, 2012 at 7:45 PM, J Gao <[email protected]> wrote: > This morning someone tried to make sip call through my Asterisk. My server > just drop these calls and record them in CDR with IP address: > > 2012-11-28 06:30:51 SIP/216... 1000 "1000" <1000> > Hangup 999011972592249388 ANSWERED 00:01 Hacker: > 168.63.67.239 > 2. 2012-11-28 06:30:49 SIP/216... 1000 "1000" <1000> > Hangup 88011972592249388 ANSWERED 00:01 Hacker: > 168.63.67.239 > 3. 2012-11-28 06:30:46 SIP/216... 1000 "1000" <1000> > Answer 99011972592249388 ANSWERED 00:02 > 4. 2012-11-28 06:30:43 SIP/216... 1000 "1000" <1000> > Answer 1011972592249388 ANSWERED 00:02 > 5. 2012-11-28 06:30:39 SIP/216... 1000 "1000" <1000> > Hangup 2011972592249388 ANSWERED 00:00 Hacker: > 168.63.67.239 > 6. 2012-11-28 06:30:33 SIP/216... 1000 "1000" <1000> > Hangup 7011972592249388 ANSWERED 00:01 Hacker: > 168.63.67.239 > 7. 2012-11-28 06:30:30 SIP/216... 1000 "1000" <1000> > Answer 8011972592249388 ANSWERED 00:03 > 8. 2012-11-28 06:30:27 SIP/216... 1000 "1000" <1000> > Hangup 9011972592249388 ANSWERED 00:06 Hacker: > 168.63.67.239 > 9. 2012-11-28 06:30:25 SIP/216... 1000 "1000" <1000> > Answer 011972592249388 ANSWERED 00:07 > > Now I noticed something interesting: The hacker's IP address: 168.63.67.239 > > whois gave me: > NetRange: 168.61.0.0 - 168.63.255.255 > CIDR: 168.61.0.0/16, 168.62.0.0/15 > OriginAS: > NetName: MSFT-EP > NetHandle: NET-168-61-0-0-1 > Parent: NET-168-0-0-0-0 > NetType: Direct Assignment > RegDate: 2011-06-22 > Updated: 2012-10-16 > Ref: http://whois.arin.net/rest/net/NET-168-61-0-0-1 > > OrgName: Microsoft Corp > OrgId: MSFT-Z > Address: One Microsoft Way > City: Redmond > StateProv: WA > PostalCode: 98052 > Country: US > RegDate: 2011-06-22 > Updated: 2011-06-22 > Ref: http://whois.arin.net/rest/org/MSFT-Z > > > hmmmmmmm.... Did I just hacked by Micro$oft? > > Gao >
http://iplocation.truevue.org/168.63.67.239.html -- _____________________________________________________________________ -- Bandwidth and Colocation Provided by http://www.api-digital.com -- New to Asterisk? Join us for a live introductory webinar every Thurs: http://www.asterisk.org/hello asterisk-users mailing list To UNSUBSCRIBE or update options visit: http://lists.digium.com/mailman/listinfo/asterisk-users
