v10 spk1 - Is this an ATTACK attempt????

[jr3151006]

HI,

I found that curious information on my logs, since the extension '100' is used only on a SIP phone (SPA 502) in our office... Is this an attack attempt??

SIP request (REGISTER) from 188.161.246.xx was rejected. Reason: Block WAN requests is ON.
Message:
REGISTER sip:201.22.XXX.173 SIP/2.0
Via: SIP/2.0/UDP 188.161.246.XX:23379;branch=z9hG4bK-d87543-383804487-1--d87543-;rport=23379
Max-Forwards: 70
Contact: <sip:[email protected]:23379>
To: <sip:[email protected]>
From: <sip:[email protected]>;tag=262a2b27
Call-ID: bb0d8e003b6db469
CSeq: 2 REGISTER
Expires: 3600
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO
Proxy-Authorization: Digest username="100",realm="3CXPhoneSystem",nonce="414d535c043b7b3b22:598bce269639f07796e41576462ac2a4",uri="sip:201.22.212.173",response="e656c241cb1a574c315533089c042479",algorithm=MD5
User-Agent: eyeBeam release 3006o stamp 17551
Content-Length: 0

 

[eagle2]

if this address 188.161.246.xx is foreign (not used by you) that was a rejected attempt for registration

this is still not an attack if not repeating (at least you need over 25 failed attempts in a short period to be considered such) - have a look on anti-hacking settings in Version 10 and search the blog / forums

regards

 

[nbailey]

hey Renato,

you have disallow extension from registering outside the local lan checked which is good, I would change the auth ID and password on this extension and keep an eye on this IP address. So no matter what they won't be able to authenticate this extension outside the lan, but do double check your settings and look into that IP address, it could be a hack attempt.

Thanks,

Nate