18.104.22.168 seemingly in Telia in Sweeden has been scanning my SIP server making calls to all extensions one by one with the RTP audio address of localhost.
Non-Codec Capability: 1
Their Codec Capability: 0
Joint Codec Capability: 14
Theoretical Address: 127.0.0.1:5095
Received Address: 22.214.171.124:5095
NAT Support: Always
Audio IP: my.server.ip (local)
Our Tag: as3131eae6
Their Tag: 3931310131363930353830303434
SIP User agent: friendly-scanner
Original uri: sip:firstname.lastname@example.org
Need Destroy: 0
Last Message: Rx: INVITE
I’ve banned them. Posting here as this IP didn’t appear anywhere on the internet so I thought I may as well start their internet presence.