Appearance strange account sip when call,

1. Brekeke Product Name and Version:
3.3.4.4 Advanced
2. Java version:
1.8.0_11
3. OS type and the version:
Windows Server 2012 R2, version 6.3
4. UA (phone), gateway or other hardware/software involved:
doubango r1025, imsdroid android app.
5. Your problem:
I use software as IMSdroid. I use LG android phone to call to Sony android phone. Sometime, it fails. When it fails, I read error logs on the sip server and see strange account appearence as:
From url: sip:101@54.187.231.181
To url: sip:110972599993825@54.187.231.181
User Agent: sipcli/v1.8.

Please explain to me reason occur and the method to solve.
Thank you.

> From url: sip:101@54.187.231.181
> To url: sip:110972599993825@54.187.231.181

Are they valid SIP URI in your service?

If not, it will be a SIP attacking.
Add the following DialPlan rule in the [Dial Plan] -> [Preliminary] page.

Matching Patterns
User-Agent = sipcli

Deploy Patterns
$action = block


FYI:
http://wiki.brekeke.com/wiki/Block-List-Honeypot

ambrosio wrote:> From url: sip:101@54.187.231.181
> To url: sip:110972599993825@54.187.231.181

Are they valid SIP URI in your service?

No, they are invalid SIP URI.

ambrosio wrote: If not, it will be a SIP attacking.
Add the following DialPlan rule in the [Dial Plan] -> [Preliminary] page.

Matching Patterns
User-Agent = sipcli

Deploy Patterns
$action = block

FYI:
http://wiki.brekeke.com/wiki/Block-List-Honeypot

I tried as your advice. I will check it.

Thank you

> User Agent: sipcli/v1.8.

sipcli is one of common attacking tools.

taitan wrote:> User Agent: sipcli/v1.8.

sipcli is one of common attacking tools.

Hi Taitan.Which other attacking tools do I need to alert?
Thank you.

Check this topic.
http://www.brekeke-sip.com/bbs/viewtopic.php?t=7419