<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>Mensagem</TITLE>
<META content="MSHTML 6.00.2900.5512" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=633242020-22012010><FONT face=Arial color=#0000ff size=2>Bruno,
é sim uma tentativa de invasão!</FONT></SPAN></DIV>
<DIV><SPAN class=633242020-22012010><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=633242020-22012010><FONT face=Arial color=#0000ff size=2>usar o
firewall para ele... mas nao vai adiantar, pq vc bloqueia um, e aparece outro...
então ao contrario de bloquear um ip, libere apenas para os ip´s
conhecidos.</FONT></SPAN></DIV>
<DIV><SPAN class=633242020-22012010><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=633242020-22012010><FONT face=Arial color=#0000ff size=2>Seque
os dados do dono desse ip, que vc pode mandar uma reclamação por email, para que
eles identifiquem a invasao que houve com eles.</FONT></SPAN></DIV>
<DIV><SPAN class=633242020-22012010><FONT face=Arial color=#0000ff
size=2>Certamente eles foram invadidos ou é de algum usuario deles mal
intencionado.</FONT></SPAN></DIV>
<DIV><SPAN class=633242020-22012010><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=633242020-22012010><PRE>OrgName: Amazon.com, Inc.
OrgID: AMAZO-4
Address: Amazon Web Services, Elastic Compute Cloud, EC2
Address: 1200 12th Avenue South
City: Seattle
StateProv: WA
PostalCode: 98144
Country: US
NetRange: 174.129.0.0 - 174.129.255.255
CIDR: 174.129.0.0/16
NetName: AMAZON-EC2-5
NetHandle: NET-174-129-0-0-1
Parent: NET-174-0-0-0-0
NetType: Direct Assignment
NameServer: PDNS1.ULTRADNS.NET
NameServer: PDNS2.ULTRADNS.NET
NameServer: PDNS3.ULTRADNS.ORG
Comment: The activity you have detected originates from a
Comment: dynamic hosting environment.
Comment: For fastest response, please submit abuse reports at
Comment: https://www.amazon.com/gp/html-forms-controller/AWSAbuse/
Comment: For more information regarding EC2 see:
Comment: http://ec2.amazonaws.com/
Comment: All reports MUST include:
Comment: * src IP
Comment: * dest IP (your IP)
Comment: * dest port
Comment: * Accurate date/timestamp and timezone of activity
Comment: * Intensity/frequency (short log extracts)
Comment: * Your contact details (phone and email)
Comment: Without these we will be unable to identify
Comment: the correct owner of the IP address at that
Comment: point in time.
RegDate: 2008-08-08
Updated: 2009-07-28
RAbuseHandle: AEA8-ARIN
RAbuseName: Amazon EC2 Abuse
RAbusePhone: +1-206-266-2187
RAbuseEmail: ec2-abuse@amazon.com
RNOCHandle: ANO24-ARIN
RNOCName: Amazon EC2 Network Operations
RNOCPhone: +1-206-266-2187
RNOCEmail: aes-noc@amazon.com
RTechHandle: ANO24-ARIN
RTechName: Amazon EC2 Network Operations
RTechPhone: +1-206-266-2187
RTechEmail: aes-noc@amazon.com
OrgAbuseHandle: AEA8-ARIN
OrgAbuseName: Amazon EC2 Abuse
OrgAbusePhone: +1-206-266-2187
OrgAbuseEmail: ec2-abuse@amazon.com
OrgTechHandle: ANO24-ARIN
OrgTechName: Amazon EC2 Network Operations
OrgTechPhone: +1-206-266-2187
OrgTechEmail: aes-noc@amazon.com
</PRE></SPAN></DIV>
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px">
<DIV></DIV>
<DIV class=OutlookMessageHeader lang=pt-br dir=ltr align=left><FONT
face=Tahoma size=2>-----Mensagem original-----<BR><B>De:</B>
asteriskbrasil-bounces@listas.asteriskbrasil.org
[mailto:asteriskbrasil-bounces@listas.asteriskbrasil.org] <B>Em nome de
</B>brunoantognolli@email.com<BR><B>Enviada em:</B> sexta-feira, 22 de janeiro
de 2010 10:37<BR><B>Para:</B>
asteriskbrasil@listas.asteriskbrasil.org<BR><B>Assunto:</B> [AsteriskBrasil]
(URGENTE) Tentativa de Invasão?<BR><BR></FONT></DIV><FONT face=arial
color=black size=2><BR><BR>
<DIV style="CLEAR: both">Pessoal, estava olhando o Log do Asterisk e ví a
seguinte msg:</DIV>
<DIV style="CLEAR: both"> </DIV>
<DIV style="CLEAR: both">[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR>[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593
handle_request_register: Registration from '"1013"
<sip:1013@XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong
password<BR></DIV>
<DIV style="CLEAR: both">Notem que em 1 segundo o "invasor" tentou várias
vezes se registrar no sip 1013 (através do método BruteForce) pelo meu link do
speedy. O IP do "invasor" é 174.129.173.249.</DIV>
<DIV style="CLEAR: both"> </DIV>
<DIV style="CLEAR: both">Isso seria uma tentativa de invasão? </DIV>
<DIV style="CLEAR: both"> </DIV>
<DIV style="CLEAR: both">Se sim, como ele conseguiu acesso aos meus ramais
SIP?</DIV>
<DIV style="CLEAR: both">O que preciso fazer para tirar esse cara da
rede?</DIV>
<DIV style="CLEAR: both"> </DIV>
<DIV style="CLEAR: both">Em uma pesquisa rápida descobri que esse IP é de
Washington.</DIV>
<DIV style="CLEAR: both"><A
href="http://www.botsvsbrowsers.com/ip/174.129.173.249/index.html">http://www.botsvsbrowsers.com/ip/174.129.173.249/index.html</A></DIV>
<DIV style="CLEAR: both"> </DIV>
<DIV style="CLEAR: both">Estou alarmado a toa ou é realmente uma tentativa de
invasão?</DIV>
<DIV style="CLEAR: both"> </DIV>
<DIV style="CLEAR: both">Obrigado lista.</DIV></BLOCKQUOTE></FONT></BODY></HTML>