Domain only registration and restrict IP registration of Extensions

[Stewart1 (Stewart)]

If your devices support it, use SIP over TLS rather than UDP.
Otherwise, if possible, use SIP over TCP.
Regardless of the protocol chosen, select a random port between 20000 and 50000, instead of 5060.

If you are forced to use UDP, set up iptables to filter by domain name.

If that is also infeasible, set up the firewall to allow only small address ranges that cover your extensions.

See my post on random SIP over UDP attacks:

Compiled list of SIP bots

In theory, but in the real world admins (for example) set up trunks with from-internal context or test extensions with very weak passwords, or simply make mistakes. Numerous cases of SIP exploits have been documented in this forum. There are many ways to gain additional protection, including avoiding SIP over UDP altogether, filtering by domain name (trivial but unpopular here, for reasons that make no sense to me), using various static or dynamic block lists (complex and IMO not very secure)…