Re: Microsoft is hacking my Asterisk??? O_o

[Mike Hammett <nanog () ics-il net>]

When I had honeypot blacklisting for my whole network, I ran across people spoofing the Google authoritative name 
servers. 




----- 
Mike Hammett 
Intelligent Computing Solutions 

Midwest Internet Exchange 

The Brothers WISP 

----- Original Message -----

From: "Dovid Bender" <dovid () telecurve com> 
To: "Mike Hammett" <nanog () ics-il net> 
Cc: "Josh Luthman" <josh () imaginenetworksllc com>, "NANOG list" <nanog () nanog org> 
Sent: Tuesday, November 3, 2020 2:47:58 PM 
Subject: Re: Microsoft is hacking my Asterisk??? O_o 


we have seen 8.8.8.8 end up on some ban lists. 




On Tue, Nov 3, 2020 at 3:17 PM Mike Hammett < nanog () ics-il net > wrote: 




Ah, so then potentially spoofed, trying to get people to honeypot blacklist XBox. 




----- 
Mike Hammett 
Intelligent Computing Solutions 

Midwest Internet Exchange 

The Brothers WISP 



From: "Josh Luthman" < josh () imaginenetworksllc com > 
To: "Mike Hammett" < nanog () ics-il net > 
Cc: "Max Tulyev" < maxtul () netassist ua >, "NANOG list" < nanog () nanog org > 
Sent: Tuesday, November 3, 2020 2:03:01 PM 
Subject: Re: Microsoft is hacking my Asterisk??? O_o 


I've seen that, a shared IP on Azure that hit my honeypot IP. Ended up being an Xbox authentication IP address one day. 





Josh Luthman 
24/7 Help Desk: 937-552-2340 
Direct: 937-552-2343 
1100 Wayne St 
Suite 1337 
Troy, OH 45373 



On Tue, Nov 3, 2020 at 2:59 PM Mike Hammett < nanog () ics-il net > wrote: 

<blockquote>


Azure? 




----- 
Mike Hammett 
Intelligent Computing Solutions 

Midwest Internet Exchange 

The Brothers WISP 



From: "Max Tulyev" < maxtul () netassist ua > 
To: nanog () nanog org 
Sent: Tuesday, November 3, 2020 1:55:45 PM 
Subject: Microsoft is hacking my Asterisk??? O_o 

Hi All, 

I have just seen a number of IPs trying to brute-force my VoIP server 
from Microsoft network. For example, 13.90.148.133, 20.55.203.249, 
40.76.244.210... Traceroute really goes to MSN. More than a half of all 
usual attempts to hack my Asterisk I got today, came from MSN. 

What is happening? Am I missed something? 





</blockquote>