Dear Sir:
In recent days, there has been a fraud with my system . I notice somebody was using my system to call north korea and somali, create $200 free calls out of my system . I did a log analysis for one of the successful call, and found after the initial INVITE, there is an immediate BYE, but obviously the call didn't really terminate. My a2billing didn't even register the call. but the call really lasted 17 minutes. after 17 minutes, I see the real BYE, and the call terminated. so my wholesale provider charged me for 17 minutes, but my a2billing didn't even register the call. thus the hacker made the call for free.
Does anybody know why this can happen ? How to fix this issue with a2billing ?
Jimmy
Jun 10 10:57:49 server1 /usr/sbin/opensips[7441]: New request - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 10:57:49 server1 /usr/sbin/opensips[7441]: load_balance - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh U=8407055028
Jun 10 10:57:49 server1 /usr/sbin/opensips[7441]: After dispatch - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh retcode=1
Jun 10 10:57:49 server1 /usr/sbin/opensips[7440]: Reply - S=100 D=Trying F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 10:57:50 server1 /usr/sbin/opensips[7439]: Reply - S=200 D=OK F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 10:57:51 server1 /usr/sbin/opensips[7442]: New request - M=ACK RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 10:58:02 server1 /usr/sbin/opensips[7441]: New request - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 10:58:02 server1 /usr/sbin/opensips[7441]: load_balance - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh U=8407055028
Jun 10 10:58:02 server1 /usr/sbin/opensips[7441]: After dispatch - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh retcode=4294967295
Jun 10 10:58:02 server1 /usr/sbin/opensips[7438]: Reply - S=100 D=Trying F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 10:58:02 server1 /usr/sbin/opensips[7441]: Reply - S=200 D=OK F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 10:58:03 server1 /usr/sbin/opensips[7443]: New request - M=ACK RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 10:58:03 server1 /usr/sbin/opensips[7442]: New request - M=INVITE RURI=sip:
[email protected]:9024 F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 10:58:03 server1 /usr/sbin/opensips[7442]: Reply - S=200 D=OK F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 10:58:04 server1 /usr/sbin/opensips[7443]: New request - M=ACK RURI=sip:
[email protected]:9024 F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 10:58:04 server1 /usr/sbin/opensips[7439]: Reply - S=200 D=OK F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 10:58:04 server1 /usr/sbin/opensips[7441]: New request - M=ACK RURI=sip:
[email protected]:9024 F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 10:58:05 server1 /usr/sbin/opensips[7439]: Reply - S=200 D=OK F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 10:58:05 server1 /usr/sbin/opensips[7443]: New request - M=ACK RURI=sip:
[email protected]:9024 F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 10:58:07 server1 /usr/sbin/opensips[7441]: Reply - S=200 D=OK F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 10:58:07 server1 /usr/sbin/opensips[7440]: New request - M=ACK RURI=sip:
[email protected]:9024 F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 10:58:15 server1 /usr/sbin/opensips[7441]: New request - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 10:58:15 server1 /usr/sbin/opensips[7441]: load_balance - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh U=8407055028
Jun 10 10:58:15 server1 /usr/sbin/opensips[7441]: After dispatch - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh retcode=4294967295
Jun 10 10:58:15 server1 /usr/sbin/opensips[7438]: Reply - S=100 D=Trying F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 10:58:16 server1 /usr/sbin/opensips[7440]: Reply - S=200 D=OK F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 10:58:16 server1 /usr/sbin/opensips[7439]: New request - M=ACK RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 10:58:42 server1 /usr/sbin/opensips[7443]: New request - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 10:58:42 server1 /usr/sbin/opensips[7443]: load_balance - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh U=8407055028
Jun 10 10:58:42 server1 /usr/sbin/opensips[7443]: After dispatch - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh retcode=4294967295
Jun 10 10:58:42 server1 /usr/sbin/opensips[7439]: Reply - S=100 D=Trying F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 10:58:42 server1 /usr/sbin/opensips[7439]: Reply - S=200 D=OK F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 10:58:42 server1 /usr/sbin/opensips[7438]: New request - M=ACK RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 11:00:11 server1 /usr/sbin/opensips[7442]: New request - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 11:00:12 server1 /usr/sbin/opensips[7442]: load_balance - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh U=8407055028
Jun 10 11:00:12 server1 /usr/sbin/opensips[7442]: After dispatch - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh retcode=4294967295
Jun 10 11:00:12 server1 /usr/sbin/opensips[7443]: Reply - S=100 D=Trying F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 11:00:12 server1 /usr/sbin/opensips[7443]: Reply - S=200 D=OK F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 11:00:13 server1 /usr/sbin/opensips[7443]: New request - M=ACK RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 11:00:15 server1 /usr/sbin/opensips[7443]: New request - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 11:00:15 server1 /usr/sbin/opensips[7443]: load_balance - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh U=8407055028
Jun 10 11:00:15 server1 /usr/sbin/opensips[7443]: After dispatch - M=INVITE RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh retcode=4294967295
Jun 10 11:00:15 server1 /usr/sbin/opensips[7440]: Reply - S=100 D=Trying F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 11:00:15 server1 /usr/sbin/opensips[7440]: Reply - S=200 D=OK F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 11:00:15 server1 /usr/sbin/opensips[7443]: New request - M=ACK RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 11:00:16 server1 /usr/sbin/opensips[7438]: Reply - S=200 D=OK F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh R=<null>
Jun 10 11:00:16 server1 /usr/sbin/opensips[7441]: New request - M=ACK RURI=sip:
[email protected] F=sip:
[email protected] T=sip:
[email protected] IP=95.246.215.97 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 11:15:54 server1 /usr/sbin/opensips[7438]: New request - M=BYE RURI=sip:
[email protected]:9024 F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 11:15:55 server1 /usr/sbin/opensips[7438]: New request - M=BYE RURI=sip:
[email protected]:9024 F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh
Jun 10 11:15:56 server1 /usr/sbin/opensips[7441]: New request - M=BYE RURI=sip:
[email protected]:9024 F=sip:
[email protected] T=sip:
[email protected] IP=89.103.211.147 ID=443a5d218c7bf938@bHVuYS1mM2M5NjAwMDZh