Re: [asterisk-users] Paltel subscribers as called parties for SIP attacks

2013-08-08 Thread Giles Coochey
On 07/08/2013 00:57, Philip Prindeville wrote: On Aug 6, 2013, at 2:59 PM, Chris Bagnall aster...@lists.minotaur.cc wrote: FWIW, we routinely see dodgy traffic from: ovh.net hetzner.de I missed the original thread, but I see a lot of attempts from the 37.8.0.0 - 37.8.63.255 range of IPs.

[asterisk-users] Paltel subscribers as called parties for SIP attacks (was: Malicious traffic comming from 37.75.210.90)

2013-08-06 Thread Philip Prindeville
For what it's worth, I see similar traffic regularly from: orange.ps hadara.ps ovh.net iweb.ca scalabledns.com securedservers.com wholesaleinternet.com hostnoc.net rackspace.com hetzner.de all going to 972-59-* numbers (i.e. Paltel/Jawal mobile customers). Common numbers are: 972592871970

Re: [asterisk-users] Paltel subscribers as called parties for SIP attacks

2013-08-06 Thread Chris Bagnall
FWIW, we routinely see dodgy traffic from: ovh.net hetzner.de But since those are 2 of the larger short-term contract dedicated server vendors, I'm not surprised about that. It's so frequent that I don't even bother reporting it any more - when an abuse report is acted upon and the server

Re: [asterisk-users] Paltel subscribers as called parties for SIP attacks

2013-08-06 Thread Philip Prindeville
On Aug 6, 2013, at 2:59 PM, Chris Bagnall aster...@lists.minotaur.cc wrote: FWIW, we routinely see dodgy traffic from: ovh.net hetzner.de But since those are 2 of the larger short-term contract dedicated server vendors, I'm not surprised about that. It's so frequent that I don't even