-=> On 06-27-18 12:18, Kees van Eeten wrote to Tony Langdon <=-

 KvE>  I cannot block Sip, as I hase users on the WAN with dynamic adresses.
 KvE>  I do use a dynamic generation of blocking rules on my firewall, but
 KvE> those

I have no external SIP users, so blocking SIP was the obvious thing to do.

 KvE>  take time. Probes can be heavy, sometimes whole 4 mumber blocks are
 KvE> scanned
 KvE>  within a few secconds. Another type of probes that apparenty is
 KvE> automated is

Yes, when I had SIP open, the probes were constant, another reason to just
block them at the firewall.

 KvE>  forwarding of calls to a specific caller. If that succeeds, they have
 KvE> found
 KvE>  the hole they are looking for and they start to offer services and
 KvE> also
 KvE>  make long call to expensive numbers abroad, to generate income there.

 KvE>  My impression is that probes on SIP surpass the probes on my
 KvE> mailserver in
 KvE>  quantity.

I'd believe that, from what I've seen eniffing incoming probes.


... She sells unix shells by the sea shore
=== MultiMail/Win v0.51
--- SBBSecho 3.03-Linux