[Freeswitch-users] FS account got hacked urgent

Fri Mar 3 23:48:25 MSK 2017

I did lolol they didn’t answer me…

From: freeswitch-users-bounces at lists.freeswitch.org [mailto:freeswitch-users-bounces at lists.freeswitch.org] On Behalf Of Tristan Mahé
Sent: Friday, March 3, 2017 2:45 PM
To: FreeSWITCH Users Help <freeswitch-users at lists.freeswitch.org>
Subject: Re: [Freeswitch-users] FS account got hacked **urgent**

You could maybe ping them on Twitter, they're quite active on  <https://twitter.com/online_fr> @online_fr .

I got in a previous life a BGP peering established that way with them.

On 03/03/2017 11:47 AM, Sergey Safarov wrote:

List of of AS12876 networks

$ whois -h whois.radb.net <http://whois.radb.net>  -- '-i origin AS12876' | grep 'route:'
route:          212.155.196.0/23 <http://212.155.196.0/23> 
route:          195.154.0.0/16 <http://195.154.0.0/16> 
route:          62.4.0.0/19 <http://62.4.0.0/19> 
route:          212.83.128.0/19 <http://212.83.128.0/19> 
route:          212.129.0.0/18 <http://212.129.0.0/18> 
route:          212.83.160.0/19 <http://212.83.160.0/19> 
route:          62.210.0.0/16 <http://62.210.0.0/16> 
route:          212.47.224.0/19 <http://212.47.224.0/19> 
route:          163.172.0.0/16 <http://163.172.0.0/16> 

Sergey

пт, 3 мар. 2017 г. в 22:24, Ken Rice <krice at freeswitch.org <mailto:krice at freeswitch.org> >:

Yes that AS is online.net <http://online.net> 's AS Number... I'm seriously considering
blackholing them across multiple networks...

-----Original Message-----
From: freeswitch-users-bounces at lists.freeswitch.org <mailto:freeswitch-users-bounces at lists.freeswitch.org> 
[mailto:freeswitch-users-bounces at lists.freeswitch.org <mailto:freeswitch-users-bounces at lists.freeswitch.org> ] On Behalf Of jungle
Boogie
Sent: Friday, March 3, 2017 12:59 PM
To: FreeSWITCH Users Help <freeswitch-users at lists.freeswitch.org <mailto:freeswitch-users at lists.freeswitch.org> >
Subject: Re: [Freeswitch-users] FS account got hacked **urgent**

On 3 March 2017 at 10:45, Ken Rice <krice at freeswitch.org <mailto:krice at freeswitch.org> > wrote:
> The problem with online.net <http://online.net>  isn't necessarily one of their clients,
> they tend to no respond to the reports they get via the link you
> posted nor do they respond to emails to their abuse@ email address as
> per their whois records...

I think I tried the email address once or twice until I found the form. IME,
the online customers resolve the situation and I stop seeing the attacks.

>
> I have received multiple attacks from various IPs on their network
> (the only thing in common with them is its originating from their AS)

hmm, that AS is with online.net <http://online.net> ?

>
> I have seen these attacks across multiple networks... I wish there was
> a way we could would with them to help mitigate this but it doesn't
> seem they are interested in it
>

I wish there was something like denyhosts for sip traffic that would sync up
and download known offenders.

_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting at freeswitch.org <mailto:consulting at freeswitch.org> 
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users at lists.freeswitch.org <mailto:FreeSWITCH-users at lists.freeswitch.org> 
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org

_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting at freeswitch.org <mailto:consulting at freeswitch.org> 
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users at lists.freeswitch.org <mailto:FreeSWITCH-users at lists.freeswitch.org> 
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org

_________________________________________________________________________
Professional FreeSWITCH Consulting Services: 
consulting at freeswitch.org <mailto:consulting at freeswitch.org> 
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users at lists.freeswitch.org <mailto:FreeSWITCH-users at lists.freeswitch.org> 
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20170303/2a2e37b9/attachment.html 