SIP Protection & why it's IMPORTANT

Cloud Kinnekt's SIP Protect Module provides protection from SIP attacks.
Brute-force break-in attempts and Denial of Service attacks are quite frequent and an unpredictable threat.

Unprotected CloudPBX systems are very sensitive to these kind of attacks.
The most common consequences of this kind of network attack are system downtime, call quality issues due to an overloaded network, direct financial loss due to network instability and unauthorised calls being made on your account to high call rate overseas countries.

Our SIP Protection Module's main purpose is to prevent those attacks.

Auto Provisioning Attack Detection

Auto-provisioning service is generally considered one of the most vulnerable spots of a CloudPBX system.

SIP Protect covers this segment as well through the integrated TFTP Brute Force attack detection. An active attacker can redirect profile provisioning request and change the configuration parameters. Then the attacker can redirect phone calls through a malicious server, change passwords, turn the phone into a bug, and exfiltrate system logs (including those numbers dialed by a user).

Advanced Threat Detection

Unlike other similar solutions, SIP Protect works with LIVE SIP traffic, constantly monitoring SIP packets being received.
Potential attacks are instantly detected and SIP Protect updates the firewall rules and blocks IP addresses from which the attack is coming for a specific amount of time, these are then listed in the table to the right and updated regularly.
To detect SIP attacks, SIP Protect uses the following advanced detection techniques: Pattern recognition, SIP Scanners protection (immediately blocking known SIP scanners), TFTP brute force protection, and SIP protocol anomaly detection.

Dynamic Blocking and Unblocking

SIP Protect features a fully automated attack protection system which blocks attacks more efficiently than most other solutions.

In the case of an attack, it updates the firewall rules and blocks IP addresses from which the attack is coming for a specific amount of time.

If attacks stop in a certain period of time, SIP Protect unblocks compromised IP addresses automatically.

Updated: 19/07/2025 1615 AEST

SYD Cluster

IP Address
Country
Type
Device
Unblock In

BNE Cluster

IP Address
Country
Type
Device
Unblock In

119.18.2.61

Australia

21h 33m 49s

122.150.164.236

Australia

21h 24m 22s

122.150.165.165

Australia

21h 21m 53s

58.84.180.16

Australia

20h 50m 5s

58.84.153.213

Australia

19h 58m 49s

203.121.220.144

Australia

13h 13m 48s

58.84.185.29

Australia

8h 6m 41s

203.121.215.152

Australia

7h 50m 30s

58.84.184.9

Australia

7h 45m 39s

58.84.135.237

Australia

5h 45m 46s

58.84.137.123

Australia

2h 27m 10s

Report abuse