[2024-11-10 01:54:54] NOTICE[10603] res_pjsip/pjsip_distributor.c: Request ‘INVITE’ from ‘sip:[email protected]’ failed for ‘205.209.149.140:51048’ (callid: 1863625452-531090387-2121923793) - Failed to authenticate
577[2024-11-10 02:00:14] NOTICE[10603] res_pjsip/pjsip_distributor.c: Request ‘INVITE’ from ‘sip:[email protected]’ failed for ‘205.209.149.140:58952’ (callid: 1854124027-412925940-766213670) - Failed to authenticate
578[2024-11-10 02:00:14] NOTICE[10603] res_pjsip/pjsip_distributor.c: Request ‘INVITE’ from ‘sip:[email protected]’ failed for ‘205.209.149.140:58952’ (callid: 1854124027-412925940-766213670) - Failed to authenticate
579[2024-11-10 02:00:14] NOTICE[10603] res_pjsip/pjsip_distributor.c: Request ‘INVITE’ from ‘sip:[email protected]’ failed for ‘205.209.149.140:58952’ (callid: 1854124027-412925940-766213670) - Failed to authenticate
580[2024-11-10 02:00:14] NOTICE[10603] res_pjsip/pjsip_distributor.c: Request ‘INVITE’ from ‘sip:[email protected]’ failed for ‘205.209.149.140:58952’ (callid: 1854124027-412925940-766213670) - No matching endpoint found after 5 tries in
David, that’s all I have. Unless you are asking for details from another log life? I’m not sure why I’m seeing these SIP invite requests? If you have any idea, please do share as I am curious.
You are seeing them because you have a SIP server open to the internet. Any such server will receive attempts to call premium rate numbers owned by the caller.
By default, FreePBX keeps a week’s worth of Asterisk logs. The current file is
/var/log/asterisk/full
and the previous days have names like
/var/log/asterisk/full-20241110
So if you have lost registration to VoIP.ms within the past week, the log entries should be there.
Even if you are inundated with malicious traffic, searching for ‘unreachable’, ‘no response’, or the VoIP.ms server domain name or IP address should find these entries.
Well, I should have known better regarding the external registrations in an attempt to make free calls. I did notice the date format used in the file names as I was in the log directory the other day, poking around and trying to resolve an issue with web call back.
It wasn’t a bright questions. I can see right in the logs that it’s a registration attempt. That’s ok, live and the only way to learn in my opinion is to get in there and mix it all up!!