I've got new attacks on multiple servers every day that slow down FreeSWITCH a lot. When under REGISTER attack, a real call can take more than 30 seconds to establish. Anyone knows how to propose new IPs to the voipabuse blacklist? I can't seem to find a submit link in the http://www.infiltrated.net/voipabuse/ website, and currently have to maintain my own blacklist. Thanks, François.
try emailing your fail2ban logs to the guy J. Oquendo <sil@infiltrated.net> also http://www.infiltrated.net/voipabuse/submitting-info.html has some info jay On Thu, Nov 25, 2010 at 8:08 PM, François Delawarde < fdelawarde@wirelessmundi.com> wrote:
I've got new attacks on multiple servers every day that slow down FreeSWITCH a lot. When under REGISTER attack, a real call can take more than 30 seconds to establish.
Anyone knows how to propose new IPs to the voipabuse blacklist? I can't seem to find a submit link in the http://www.infiltrated.net/voipabuse/ website, and currently have to maintain my own blacklist.
Thanks, François.
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely Jay
On Thu, 2010-11-25 at 22:03 +1000, jay binks wrote:
also http://www.infiltrated.net/voipabuse/submitting-info.html has some info
I can see some "please provide us" or "please contact me" but no address whatsoever. Any clue I might have missed? François.
I spent most of the day putting together a module for fail2ban along with a small server package so I can share the blocking data between my servers in an automated fashion without a lot of delay. It's a basic version of what denyhosts does for ssh as far as sharing the details on hacking attempts. It's not done yet but if anybody is interested in helping me test just drop me an email and I'll be glad to get you access to it. Our hacking attempts via ssh dropped when we started using denyhosts and I'd like to see the same thing here. Darren Wiebe On 25/11/2010 6:22 AM, François Delawarde wrote:
On Thu, 2010-11-25 at 22:03 +1000, jay binks wrote:
also http://www.infiltrated.net/voipabuse/submitting-info.html has some info I can see some "please provide us" or "please contact me" but no address whatsoever. Any clue I might have missed?
François.
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (3)
-
Darren Wiebe
-
François Delawarde
-
jay binks