Report Finds Industrial-Scale SIP Credential Spraying and UK Toll-Fraud Probing
Summary
An 18-day SIP honeypot study recorded 1.87 million credential attempts across 29,433 extensions and 89,465 call attempts, many targeting UK revenue-share ranges. The honeypot rejected all authentication attempts.
Key points
- The sensor recorded about 3.79 million distinct SIP requests from 323 source addresses over 18 days.
- Researchers observed 1,869,521 registration authentication attempts against 29,433 extension identities; 96.09% of the credential attempts could be resolved to plaintext passwords.
- The captured credentials yielded 277,632 unique passwords and 1,499,846 unique extension/password pairs.
- Of 89,465 call-setup attempts, 47,273 targeted UK number ranges, with activity concentrated in rural and Northern Ireland ranges.
- Attack traffic was highly concentrated: OVH’s AS16276 accounted for 6,559,589 events, and one /24 produced 5,178,084.
- The honeypot rejected every authentication attempt; the report describes intelligence gathered, not a successful compromise.
Article Details
- Publisher
- CloudSek
- Report Period
- 18-day observation window; exact dates and year not stated
- Scope
- Telemetry from a single Internet-facing SIP service, including registration authentication attempts and call-setup attempts
- Sample Size
- 15,183,358 telemetry events; approximately 3,787,791 distinct SIP requests from 323 unique source addresses
- Key Statistics
- 1,869,521 SIP registration authentication attempts across 29,433 extension identities.
- 89,465 call-setup (INVITE) attempts; 47,273 targeted UK numbers.
- The report states that plaintext passwords could be determined for 96.09% of credential attempts, yielding 277,632 unique passwords.
- One hosting network (OVH, AS16276) originated 6,559,589 events; the 15.204.157.0/24 range produced 5,178,084 events.