[130598] in North American Network Operators' Group
Re: Scam telemarketers spoofing our NOC phone number for callerid
daemon@ATHENA.MIT.EDU (Graham Beneke)
Wed Oct 6 15:19:26 2010
Date: Wed, 06 Oct 2010 21:16:04 +0200
From: Graham Beneke <graham@apolix.co.za>
To: nanog@nanog.org
In-Reply-To: <AANLkTikD7in6K21J8uOiTB8xdAD5=ZhCnRkFtz3Arq=1@mail.gmail.com>
X-Report-Abuse-To: abuse@apolix.co.za
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On 06/10/2010 17:15, William Herrin wrote:
> I had my unpublished asterisk box up for all of two days before
> getting half a megabit per second worth of false SIP registration
> attempts.
The script kiddies and botnets seem to by trying hard.
I started announcing a brand new RIR allocation about 4 days ago and
decided to tcpdump the background noise on the prefix before it gets
used in production. About 80% of the traffic is systematic scanning on
port 5060 across the entire prefix.
--
Graham Beneke
