[nsp-sec] SIP Invite of interest, OrbitLines.

[Scott A. McIntyre]

Hi teams,

In looking at my SIP honeypot data for yesterday, I noticed an usual
invite:  48123950270.  That is apparently a test-number for premium rate
services in Poland.  Makes sense that VoIP hackers would be testing
against something like that.

The requests came from:

Sat Oct 22 10:49:03 2011	176.67.120.121	AS51407 Mada Alarab AS	Mada
Alarab AS	Palestinian Territory	

(Times are UTC+1100)

Looking at the phone number in question, I found an interesting reference:

http://www.orbitlines.com/about-us/

And specifically:

http://www.orbitlines.com/test-numbers/

I didn't have any other hits to these test-numbers, but if someone else
has done some research on these folks, I'd like to know.  Feels
decidedly dodgy to me.

Cheers,

Scott A. McIntyre
Telstra