search for: stateprov

Just idly watching * in console mode and saw that someone from 50.49.54.102 tried to register with my *. whois gives:- OrgName: Internet Assigned Numbers Authority OrgID: IANA Address: 4676 Admiralty Way, Suite 330 City: Marina del Rey StateProv: CA PostalCode: 90292-6695 Country: US NetRange: 50.0.0.0 - 50.255.255.255 CIDR: 50.0.0.0/8 NetName: RESERVED-50 NetHandle: NET-50-0-0-0-0 Parent: NetType: IANA Reserved Comment: RegDate: Updated: 2002-08-23 OrgTechHandle: IANA-ARIN OrgTechName: Internet Corporation for As...

Hi All, I've been banging my head on a small dundi problem... I have two * servers setup, both have almost identical dundi.conf files: root@tsjonge:/opt/asterisk/etc# cat dundi.conf [general] department=thuis organization=pipsworld locality=Amsterdam stateprov=NH country=NL email=remco@pipsworld.nl phone=+31207508308 ;bindaddr=0.0.0.0 ;port=4520 entity=00:02:b3:49:69:5e ttl=16 autokill=yes ;secretpath=dundi [mappings] ;pipsworld => pipsworld,1,IAX2,dundi:${SECRET}@tsjonge.pipsworld.nl/${NUMBER},nopartial ;pipsworld => external,1000,IAX2,guest...

...-1 Parent: NET-168-0-0-0-0 NetType: Direct Assignment RegDate: 2011-06-22 Updated: 2012-10-16 Ref: http://whois.arin.net/rest/net/NET-168-61-0-0-1 OrgName: Microsoft Corp OrgId: MSFT-Z Address: One Microsoft Way City: Redmond StateProv: WA PostalCode: 98052 Country: US RegDate: 2011-06-22 Updated: 2011-06-22 Ref: http://whois.arin.net/rest/org/MSFT-Z hmmmmmmm.... Did I just hacked by Micro$oft? Gao --

...DUNDi between only two servers? Should I be using a dummy context on one server to handle this? I'm listing the relevant files below for only one server for brevities sake. ----------------------------------- dundi.conf [general] department=Test Lab organization=My Test lab locality=Anywhere stateprov=CA country=US email=email at email.com phone=+5555555555 entityid=00:11:22:33:44:55 cachetime=5 ttl=1 autokill=yes [mappings] dundified => internal,0,SIP,${NUMBER}@server1.domain.com<NUMBER%7D at server1.domain.com> ,nopartial [55:44:33:22:11:00] model=symmetric host=server2.domain.com i...

...ization: DoD Network Information Center (DNIC) RegDate: 1998-06-04 Updated: 2011-06-21 Ref: https://whois.arin.net/rest/net/NET-215-0-0-0-1 OrgName: DoD Network Information Center OrgId: DNIC Address: 3990 E. Broad Street City: Columbus StateProv: OH So how is someone on a Dutch ISP using my server to mess with a US DoD ip address ?

...//whois.arin.net/rest/net/NET-215-0-0-0-1 > <https://whois.arin.net/rest/net/NET-215-0-0-0-1> > > > > OrgName:? ? ? ? DoD Network Information Center > OrgId:? ? ? ? ? DNIC > Address:? ? ? ? 3990 E. Broad Street > City:? ? ? ? ? ?Columbus > StateProv:? ? ? OH > > So how is someone on a Dutch ISP using my server to mess with a US > DoD ip address ? > > > -- I don't see how fail2ban would help. asterisk isn't rejecting anything. There's no attempt with username/password. How could I use iptables to...

We have been noticing flurries of sshd reject messages in which some system out there in the hinterlands hits us with a flood of ssh login attempts. An example: Apr 6 05:41:51 dc sshd[88763]: Did not receive identification string from 67.19.58.170 Apr 6 05:49:42 dc sshd[12389]: input_userauth_request: illegal user anonymous Apr 6 05:49:42 dc sshd[12389]: Failed password for illegal user