that looks like a proxy log. the call is being initiated from a user line, but the user is "xxx'd" out by you.
Since the call is using TCP, my guess is that it is a remote user or a user with softphone, and the user has been hacked. Since the user has to pass through the proxy credentials in order to place a call, and if you feel the user has been compromised, you should remove the user or change the users credentials and have him/her get their system checked out before providing them with the credentials to authenticate. It is also possible a user changed their softphone username/password to say "anon anon" and is trying to place the call. On Tue, Feb 23, 2010 at 4:38 AM, an...@iguanait.com <an...@iguanait.com>wrote: > Hi again. We have installed sipxecs-4.0.4-017289 on Centos 5. > > This morning i saw a very strange records in my sipregister logs. > > It looks that somebody is trying (or it registered successfully) > register and make calls through our system with one of our extension. > I checked on Call Details Records screen and i see that call to > 00930820128 has failed. I cannot see any other records for this > registration and call in logs. > > FROM TO START DURATION STATUS > anon anon - xxx0 00930820128 2/23/10 6:43 AM 0 seconds Failed > > Was this extension hacked? How can i protect my system from this kind of > things? > > I attached sipregister logs. > > _______________________________________________ > sipx-users mailing list sipx-users@list.sipfoundry.org > List Archive: http://list.sipfoundry.org/archive/sipx-users > Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users > sipXecs IP PBX -- http://www.sipfoundry.org/ > -- ====================== Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: tgrazi...@myitdepartment.net LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ Why do mathematicians always confuse Halloween and Christmas? Because 31 Oct = 25 Dec.
_______________________________________________ sipx-users mailing list sipx-users@list.sipfoundry.org List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/
