SIP attack with fake header

[david55]

This is the thread I was thinking about, although it seems to have petered out before it was established why the security log wasn’t working for its OP:

Spoofed Brute force

Hello. Last 4 days, my pbx is getting attention by brute forcers that spoof their source ip by using my pbx’s as source. After inspecting a live attempt, the only way to catch original src ip is with sip trace. Thing is Fail2Ban doesnt detect this. Has anyone a solution on how to catch those kind of attempts?? Any help will be appreciated.