Previously unseen hack attempt type

[leejor]

Is anyone else seeing this happen on hacker registration attempts?

The originating IP changes (in this case 96.77.93.196) , and becomes blocked by 3CX after two failed attempts, BUT the Contact IP, which remains the same in several hundred logs, does not. Even with 212.83.165.111 (France) in the blacklist, the attempts continued until I forced the dynamic public IP to change with a router (MAC) swap. The IPs that are blocked are all over the place (seemingly no consistency in the origin).

I have never seen this before.


09-Sep-2021 07:29:46.133 [CM102001]: Authentication failed for AuthFail Recv Req REGISTER from 96.77.93.196:5060 tid=168eaea232e04e9d603786ed5a54d484.0 Call-ID=wkmgieqilsnxydddimsgfxsdymdjjbwlgasllcsvcfmuulpoho:
REGISTER sip:XX.XXX.26.73 SIP/2.0
Via: SIP/2.0/UDP 96.77.93.196:5060;branch=z9hG4bK168eaea232e04e9d603786ed5a54d484.0
Via: SIP/2.0/UDP 212.83.165.111:5502;branch=z9hG4bKb920225b-5d32-45bb-980e-5d9962bc85d5;received=212.83.165.111;rport=5502
Max-Forwards: 69
Contact: <sip:8707@212.83.165.111:5502;rinstance=9fa19dcd24b2134e>
To: "8707"<sip:[email protected].26.73>
From: "8707"<sip:[email protected].26.73>;tag=mjskxxqi
Call-ID: wkmgieqilsnxydddimsgfxsdymdjjbwlgasllcsvcfmuulpoho
CSeq: 2 REGISTER
Expires: 3600
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE
Proxy-Authorization: Digest username="8707",realm="3CXPhoneSystem",nonce="414d535c174aab5987:62a8347fc2bba514598058001fbc9448",response="3b5ce9dcb60b23785d50f74504f249ed",uri="sip:XX.XXX.26.73",algorithm=MD5
Supported: 100rel
User-Agent: Linksys/SPA941-1.10.0
Content-Length: 0

 

[NickD_3CX]

Hackers are getting smarter and are trying to find ways to circumvent the classic Blacklisting tactics software usually has.
We have seen it quite a lot, requests originating from different IPs so that they get more 'shots' at brute forcing.

This is way it is becoming increasingly important to have the "3CX Global Blacklist" enabled. This way we can collate all attempts into a central list and distribute that out to all systems.

In your case, the Originating IP got blacklisted, right? Not the one in the 'Contact'.