SIP Attack : 82.165.122.88 & 91.121.218.38 & 94.23.161.138

[FredR]

# grep "not found for endpoint 'anonymous'" /var/log/asterisk/full | awk '{print $13}' | sed 's/(/ /g' | sed 's/:/ /g' | awk '{print $1}' | sort -n | uniq -c | tail
  13574 82.165.122.88
   1186 91.121.218.38
    537 94.23.161.138

82.165.122.88 => Germany
91.121.218.38 => France (OVH)
94.23.161.138 => Germany (OVH)

[FredR]

Full list in all logs :

# grep "not found for endpoint 'anonymous'" /var/log/asterisk/full* | awk '{print $13}' | sed 's/(/ /g' | sed 's/:/ /g' | awk '{print $1}' | sort -n | uniq -c | sort -n | tail
    539 94.23.161.138
    868 198.98.56.123
    968 185.243.5.86
   4934 91.121.218.38
   5414 212.83.150.16
  13634 82.165.122.88
  25542 185.209.15.176
  31910 152.42.131.180
 118093 23.94.31.134
 167525 2.57.121.148

23.94.31.134 => United States
2.57.121.148 => England

[FredR]

Other list :

# grep "rejected because extension not found in context" /var/log/asterisk/full* | awk '{print $8}' | sed 's/(/ /g' | sed 's/:/ /g' | awk '{print $2}' | sort -n | uniq -c | sort -n | tail -15
    102 107.189.19.192
    167 198.12.68.114
    179 185.243.5.88
    232 199.188.103.10
    351 185.243.5.86
    406 192.210.184.18
    506 198.23.190.58
    605 23.94.82.250
    609 96.44.142.62
   1105 185.243.5.75
   2315 185.243.5.109
   2929 185.243.5.68
   6364 185.243.5.92
  11673 64.95.96.132
 158464 2.57.121.148

[FredR]

L’IP a bloqué en priorité : 2.57.121.148 .