Change your SIP port to something completely weird and non-standard
(from 5060). You'll likely never hear from whoever it is again.

Sometimes "security by obscurity" really *does* effectively function.

Jim

> Date: Sun, 23 Jun 2013 13:57:40 -0600
> From: kb0kzr@matthouse.com
> To: app_rpt-users@ohnosec.org
> Subject: [App_rpt-users] Bogus SIP registrations
>
> All--
>
> While diagnosing another problem (which I will post about in a little bit
> if I can't get it figured out, but I wanted to keep separate threads
> separate) -- suddenly somebody started sending me a ton of bogus SIP
> registrations. The source-IP is 210.73.202.76 for whatever that may be
> worth. I thought about firewalling it, but I don't think SIP is required
> at all for app_rpt to work? So I disabled chan_sip entirely in
> modules.conf.
>
> Just throwing it out there as something to consider for other app_rpt
> nodes... I don't know of any security flaws in chan_sip, but I figured
> since it isn't being used there's no reason to run it.
>
> -Matt-
>
> _______________________________________________
> App_rpt-users mailing list
> App_rpt-users@ohnosec.org
> http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users