usken.no - VoIP news! » port http://www.usken.no VoIP news for VoIP people! Thu, 09 Sep 2010 14:13:23 +0000 http://wordpress.org/?v=2.9.1 en hourly 1 Why are there VoIP attacks from port 3058? http://www.usken.no/2009/12/why-are-there-voip-attacks-from-port-3058/ http://www.usken.no/2009/12/why-are-there-voip-attacks-from-port-3058/#comments Mon, 28 Dec 2009 10:31:03 +0000 sjur http://www.usken.no/?p=304 Been picking up more and more hits in the VoIP honeypots lately. What puzzles me, is that several of those originate from different IPs but same port number. IANA assigned port 3058 to the following:

videobeans 3058/tcp videobeans
videobeans 3058/udp videobeans

IPs that has hit one or more of our honeypots the latest days:

From port 3058
64.62.243.6
67.23.3.128
69.64.38.111

Other ports
174.129.70.133
207.239.216.52
207.239.216.53
208.38.164.48

Notice the two consecutive IPs, 207.239.216.52 and .53.

But why port 3058… the reason is probably simple, but for now I’m guessing on the same software running on PCs with a public IP.

]]> http://www.usken.no/2009/12/why-are-there-voip-attacks-from-port-3058/feed/ 0