Send VoiceOps mailing list submissions to
[email protected]
To subscribe or unsubscribe via the World Wide Web, visit
https://puck.nether.net/mailman/listinfo/voiceops
or, via email, send a message with subject or body 'help' to
[email protected]
You can reach the person managing the list at
[email protected]
When replying, please edit your Subject line so it is more specific
than "Re: Contents of VoiceOps digest..."
Today's Topics:
1. Re: Catching alot of attempts at fraud to Israel.... (PE)
2. Re: Catching alot of attempts at fraud to Israel.... (Gavin Henry)
3. Re: Catching alot of attempts at fraud to Israel....
(Simon Woodhead)
----------------------------------------------------------------------
Message: 1
Date: Wed, 29 May 2013 09:35:55 -0400
From: PE <[email protected]>
To: Oren Yehezkely <[email protected]>
Cc: "[email protected]" <[email protected]>
Subject: Re: [VoiceOps] Catching alot of attempts at fraud to
Israel....
Message-ID:
<CAHm=sakto9jdwz88f69lanfu1da6twohrjjtdgp4rab1tzm...@mail.gmail.com>
Content-Type: text/plain; charset="windows-1252"
Here's another: 972597708294 (UA sipcli/v1.8)
On Fri, May 24, 2013 at 1:15 PM, Oren Yehezkely <[email protected]> wrote:
> Did you try using fail2ban?
>
> Works well for us.
>
> Oren
>
>
> On Thu, May 23, 2013 at 3:57 PM, PE <[email protected]> wrote:
>
>> Here are some more. All coming from user-agent: sipcli/v1.8
>>
>> 972592172000 972592172400 972592172450 972592100000 972592170000
>> 972592511626
>>
>>
>> On Wed, May 22, 2013 at 5:36 PM, Ryan Delgrosso
>> <[email protected]>wrote:
>>
>>> Yep Ive just started seeing this ramp up as well.
>>>
>>> Here are some of the numbers I am seeing in the last few days.
>>>
>>> 972599913643
>>> 972573188884
>>> 972527163677
>>> 972573188810
>>> 972779219219
>>> 972548492080
>>> 972573111099
>>> 972573170707
>>>
>>> Anyone care to expand on this?
>>>
>>> -Ryan
>>>
>>>
>>> On 05/15/2013 03:11 PM, David Thompson wrote:
>>>
>>> I?m catching a lot of attempts at fraud to Israel has anyone else out
>>> there been catching any? Country code is 972.
>>>
>>>
>>>
>>> David Thompson
>>> Network Services Support Technician
>>> (O) 858.357.8794
>>> (F) 858-225-1882
>>> (E) [email protected]
>>> (W) www.esi-estech.com
>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> VoiceOps mailing
>>> [email protected]https://puck.nether.net/mailman/listinfo/voiceops
>>>
>>>
>>>
>>> _______________________________________________
>>> VoiceOps mailing list
>>> [email protected]
>>> https://puck.nether.net/mailman/listinfo/voiceops
>>>
>>>
>>
>> _______________________________________________
>> VoiceOps mailing list
>> [email protected]
>> https://puck.nether.net/mailman/listinfo/voiceops
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://puck.nether.net/pipermail/voiceops/attachments/20130529/385f968d/attachment-0001.html>
------------------------------
Message: 2
Date: Wed, 29 May 2013 15:16:21 +0100
From: Gavin Henry <[email protected]>
To: PE <[email protected]>
Cc: [email protected]
Subject: Re: [VoiceOps] Catching alot of attempts at fraud to
Israel....
Message-ID:
<capcb_g+jew7uvvf3vzpuqsvj4kr2wjdeb-wsqdzkm2xgmnq...@mail.gmail.com>
Content-Type: text/plain; charset="windows-1252"
We're (SureVoIP) are getting the same with that UA too.
We've just put into production Homer SIP Capture and the stats tool is
showing that UA almost top.
Cheers.
On 29 May 2013 14:44, "PE" <[email protected]> wrote:
> Here's another: 972597708294 (UA sipcli/v1.8)
>
>
> On Fri, May 24, 2013 at 1:15 PM, Oren Yehezkely <[email protected]> wrote:
>
>> Did you try using fail2ban?
>>
>> Works well for us.
>>
>> Oren
>>
>>
>> On Thu, May 23, 2013 at 3:57 PM, PE <[email protected]> wrote:
>>
>>> Here are some more. All coming from user-agent: sipcli/v1.8
>>>
>>> 972592172000 972592172400 972592172450 972592100000 972592170000
>>> 972592511626
>>>
>>>
>>> On Wed, May 22, 2013 at 5:36 PM, Ryan Delgrosso <[email protected]
>>> > wrote:
>>>
>>>> Yep Ive just started seeing this ramp up as well.
>>>>
>>>> Here are some of the numbers I am seeing in the last few days.
>>>>
>>>> 972599913643
>>>> 972573188884
>>>> 972527163677
>>>> 972573188810
>>>> 972779219219
>>>> 972548492080
>>>> 972573111099
>>>> 972573170707
>>>>
>>>> Anyone care to expand on this?
>>>>
>>>> -Ryan
>>>>
>>>>
>>>> On 05/15/2013 03:11 PM, David Thompson wrote:
>>>>
>>>> I?m catching a lot of attempts at fraud to Israel has anyone else out
>>>> there been catching any? Country code is 972.
>>>>
>>>>
>>>>
>>>> David Thompson
>>>> Network Services Support Technician
>>>> (O) 858.357.8794
>>>> (F) 858-225-1882
>>>> (E) [email protected]
>>>> (W) www.esi-estech.com
>>>>
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> VoiceOps mailing
>>>> [email protected]https://puck.nether.net/mailman/listinfo/voiceops
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> VoiceOps mailing list
>>>> [email protected]
>>>> https://puck.nether.net/mailman/listinfo/voiceops
>>>>
>>>>
>>>
>>> _______________________________________________
>>> VoiceOps mailing list
>>> [email protected]
>>> https://puck.nether.net/mailman/listinfo/voiceops
>>>
>>>
>>
>
> _______________________________________________
> VoiceOps mailing list
> [email protected]
> https://puck.nether.net/mailman/listinfo/voiceops
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://puck.nether.net/pipermail/voiceops/attachments/20130529/c5735002/attachment-0001.html>
------------------------------
Message: 3
Date: Wed, 29 May 2013 15:44:53 +0100
From: Simon Woodhead <[email protected]>
To: Gavin Henry <[email protected]>
Cc: [email protected]
Subject: Re: [VoiceOps] Catching alot of attempts at fraud to
Israel....
Message-ID:
<caep9jpc0gkuerg0blx7scvxfv6vitwt6p8m38_hbepndwlw...@mail.gmail.com>
Content-Type: text/plain; charset="windows-1252"
Second only to friendly-scanner in our honeypots:
http://mirror.simwood.com/honeypot/honeypot_agent_1y.csv
On 29 May 2013 15:16, Gavin Henry <[email protected]> wrote:
> We're (SureVoIP) are getting the same with that UA too.
>
> We've just put into production Homer SIP Capture and the stats tool is
> showing that UA almost top.
>
> Cheers.
> On 29 May 2013 14:44, "PE" <[email protected]> wrote:
>
>> Here's another: 972597708294 (UA sipcli/v1.8)
>>
>>
>> On Fri, May 24, 2013 at 1:15 PM, Oren Yehezkely <[email protected]>wrote:
>>
>>> Did you try using fail2ban?
>>>
>>> Works well for us.
>>>
>>> Oren
>>>
>>>
>>> On Thu, May 23, 2013 at 3:57 PM, PE <[email protected]> wrote:
>>>
>>>> Here are some more. All coming from user-agent: sipcli/v1.8
>>>>
>>>> 972592172000 972592172400 972592172450 972592100000 972592170000
>>>> 972592511626
>>>>
>>>>
>>>> On Wed, May 22, 2013 at 5:36 PM, Ryan Delgrosso <
>>>> [email protected]> wrote:
>>>>
>>>>> Yep Ive just started seeing this ramp up as well.
>>>>>
>>>>> Here are some of the numbers I am seeing in the last few days.
>>>>>
>>>>> 972599913643
>>>>> 972573188884
>>>>> 972527163677
>>>>> 972573188810
>>>>> 972779219219
>>>>> 972548492080
>>>>> 972573111099
>>>>> 972573170707
>>>>>
>>>>> Anyone care to expand on this?
>>>>>
>>>>> -Ryan
>>>>>
>>>>>
>>>>> On 05/15/2013 03:11 PM, David Thompson wrote:
>>>>>
>>>>> I?m catching a lot of attempts at fraud to Israel has anyone else
>>>>> out there been catching any? Country code is 972.
>>>>>
>>>>>
>>>>>
>>>>> David Thompson
>>>>> Network Services Support Technician
>>>>> (O) 858.357.8794
>>>>> (F) 858-225-1882
>>>>> (E) [email protected]
>>>>> (W) www.esi-estech.com
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> VoiceOps mailing
>>>>> [email protected]https://puck.nether.net/mailman/listinfo/voiceops
>>>>>
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> VoiceOps mailing list
>>>>> [email protected]
>>>>> https://puck.nether.net/mailman/listinfo/voiceops
>>>>>
>>>>>
>>>>
>>>> _______________________________________________
>>>> VoiceOps mailing list
>>>> [email protected]
>>>> https://puck.nether.net/mailman/listinfo/voiceops
>>>>
>>>>
>>>
>>
>> _______________________________________________
>> VoiceOps mailing list
>> [email protected]
>> https://puck.nether.net/mailman/listinfo/voiceops
>>
>>
> _______________________________________________
> VoiceOps mailing list
> [email protected]
> https://puck.nether.net/mailman/listinfo/voiceops
>
>
--
***** Email confidentiality notice *****
This message is private and confidential. If you have received this message in
error, please notify us and remove it from your system.
Simwood eSMS Limited is a limited company registered in England and Wales.
Registered number: 03379831. Registered office: c/o HW Chartered Accountants,
Keepers Lane, The Wergs, Wolverhampton, WV6 8UA. Trading address: Falcon Drive,
Cardiff Bay, Cardiff, CF10 4RU.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://puck.nether.net/pipermail/voiceops/attachments/20130529/3f77d904/attachment.html>
------------------------------
Subject: Digest Footer
_______________________________________________
VoiceOps mailing list
[email protected]
https://puck.nether.net/mailman/listinfo/voiceops
------------------------------
End of VoiceOps Digest, Vol 47, Issue 19
****************************************
