Thanks for reply and good explanation. On Tue, 2010-02-23 at 05:07 -0500, Tony Graziano wrote: > that looks like a proxy log. the call is being initiated from a user > line, but the user is "xxx'd" out by you. > > > Since the call is using TCP, my guess is that it is a remote user or a > user with softphone, and the user has been hacked. > > > Since the user has to pass through the proxy credentials in order to > place a call, and if you feel the user has been compromised, you > should remove the user or change the users credentials and have > him/her get their system checked out before providing them with the > credentials to authenticate. > > > It is also possible a user changed their softphone username/password > to say "anon anon" and is trying to place the call. > > On Tue, Feb 23, 2010 at 4:38 AM, an...@iguanait.com > <an...@iguanait.com> wrote: > Hi again. We have installed sipxecs-4.0.4-017289 on Centos 5. > > This morning i saw a very strange records in my sipregister > logs. > > It looks that somebody is trying (or it registered > successfully) > register and make calls through our system with one of our > extension. > I checked on Call Details Records screen and i see that call > to > 00930820128 has failed. I cannot see any other records for > this > registration and call in logs. > > FROM TO START DURATION STATUS > anon anon - xxx0 00930820128 2/23/10 6:43 AM 0 seconds Failed > > Was this extension hacked? How can i protect my system from > this kind of > things? > > I attached sipregister logs. > > _______________________________________________ > sipx-users mailing list sipx-users@list.sipfoundry.org > List Archive: http://list.sipfoundry.org/archive/sipx-users > Unsubscribe: > http://list.sipfoundry.org/mailman/listinfo/sipx-users > sipXecs IP PBX -- http://www.sipfoundry.org/ > > > > -- > ====================== > Tony Graziano, Manager > Telephone: 434.984.8430 > Fax: 434.984.8431 > > Email: tgrazi...@myitdepartment.net > > LAN/Telephony/Security and Control Systems Helpdesk: > Telephone: 434.984.8426 > Fax: 434.984.8427 > > Helpdesk Contract Customers: > http://www.myitdepartment.net/gethelp/ > > Why do mathematicians always confuse Halloween and Christmas? > Because 31 Oct = 25 Dec. > >
_______________________________________________ sipx-users mailing list sipx-users@list.sipfoundry.org List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/
