Protect Your VoIP/PBX Server from SIP Password Attacks with Automatic IP Blocking
RdpGuard
Intrusion prevention system for your Windows Server
 

VoIP/SIP Brute-Force Protection for Windows

An Internet-facing VoIP/PBX server attracts automated scanners looking for valid extensions and weak SIP passwords.

A compromised account can leave your business paying for unauthorized international or premium-rate calls. Even unsuccessful password attacks can consume server resources and fill your logs with repeated registration and authentication requests.

Attackers can probe extension numbers before trying passwords for the accounts they find. The following SIP server log excerpt shows repeated REGISTER requests targeting extensions 100, 101 and 102 from the same remote IP address:

Time      Remote IP      Method    Ext.  Response
01:30:24  104.155.45.68  REGISTER     401 Unauthorized
01:30:30  104.155.45.68  REGISTER     401 Unauthorized
01:30:36  104.155.45.68  REGISTER     401 Unauthorized
Selected fields from the SIP server log.
View full SIP log
[2017/12/07 01:30:24,286] SEND,104.155.45.68:55428
	SIP/2.0 401 Unauthorized
	Via: SIP/2.0/TCP 10.240.0.7
	From: Nessus <sip:10.240.0.7:55428>;tag=0621306b-529e-4de3-8af3-16c2add9ee9a
	To: <sip:100@10.240.0.7:5060>;tag=a162044457133908
	Contact: <sip:@54.145.237.120:5060>
	Call-ID: 0e03060d-8ed9-423b-8a87-a869b2c0c63f
	CSeq: 361100138 REGISTER
	Warning: 399 104.155.45.68 "Digest authorization required"
	WWW-Authenticate: Digest realm="172.30.2.236", nonce="752341025378199770a104b155b45b68", stale=FALSE, algorithm=MD5
	Server: MizuVoIPServer 8.6
	Content-Length: 0

[2017/12/07 01:30:30,96] SEND,104.155.45.68:57620
	SIP/2.0 401 Unauthorized
	Via: SIP/2.0/TCP 10.240.0.7
	From: Nessus <sip:10.240.0.7:57620>;tag=7e1c5fae-72db-4e42-9fe2-4615477df7c9
	To: <sip:101@10.240.0.7:5060>;tag=a191130192120953
	Contact: <sip:@54.145.237.120:5060>
	Call-ID: 2042b411-fdf0-4ef1-ae74-68ac6445cf68
	CSeq: 1674088010 REGISTER
	Warning: 399 104.155.45.68 "Digest authorization required"
	WWW-Authenticate: Digest realm="172.30.2.236", nonce="752399215815299769a104b155b45b68", stale=FALSE, algorithm=MD5
	Server: MizuVoIPServer 8.6
	Content-Length: 0

[2017/12/07 01:30:36,153] SEND,104.155.45.68:59834
	SIP/2.0 401 Unauthorized
	Via: SIP/2.0/TCP 10.240.0.7
	From: Nessus <sip:10.240.0.7:59834>;tag=1e0db670-d96b-4826-9863-aa17f45e34fc
	To: <sip:102@10.240.0.7:5060>;tag=a112172719731331
	Contact: <sip:@54.145.237.120:5060>
	Call-ID: ce597314-fb00-4c26-ad40-121be94cde0f
	CSeq: 101627762 REGISTER
	Warning: 399 104.155.45.68 "Digest authorization required"
	WWW-Authenticate: Digest realm="172.30.2.236", nonce="752459741691999768a104b155b45b68", stale=FALSE, algorithm=MD5
	Server: MizuVoIPServer 8.6
	Content-Length: 0

RdpGuard monitors SIP authentication on your Windows server and automatically blocks IP addresses after repeated failed attempts. You control the detection limit and blocking period, helping reduce repeated password attacks and the risk of toll fraud.

Supports unencrypted SIP over IPv4 (TCP and UDP) on Windows servers. See the setup guide for requirements and configuration.

For 64-bit Windows and Windows Server. Supported Windows versions.

See Also

How to enable and configure VoIP/SIP brute-force protection - choose a traffic monitoring method, select the network adapter and set your SIP ports.

RdpGuard 10.3.7 Free Trial

RdpGuard protects:

Our customers say

"This sotware is really great. It's a relief. Because my server is constantly under attack. Thanks RdpGuard" - Joaquim De Sousa Marques

"Nice product. I used to implement something similiar in a low-tech and cumbersome manner via a script called TSBlock (not mine). This makes it much easier and is well worth the pricetag for SMB's." - J. Johnson

"Absolutely amazed at your product. We are a church in the North Dallas area, and I discovered this morning multiple failed logon attempts via our Remote Access Server. A friend suggested your product, so I immediately downloaded the trial. It had a list of about five blocked IP addresses in minutes, and that was enough to lead me to push the BUY button. Over the past 10-15 minutes the list is now about thirty with at least a third being international attempts to break into our system. Thanks for a great product. You may have just saved us much grief." - John Hallford

"Love the software. RDP on our Windows servers is just ridiculous. We would block it in the router but we have lots of old-time customers that would have issues." - Scott Hirsch

"Love the software! Makes it easier than tailoring VB Scripts!!" - Nick Brennan

"It's a great product - really stopping those RDP attackers :-)" - Dave, UK

"First of all: Your application is very (!!!) useful and I like it very much securing my 2012 R2 server. RdpGuard is the best solution, I found on the market and after 10 minutes of testing it I ordered the fully-featured version. :-)" - Carsten Baltes

Our Other Products
Copyright © 2012-2026 Netsdk Software FZE. All rights reserved.  Terms of Use.  Privacy Policy.