3 ms·
I love investigating internet background radiation, this is interesting research. I've definitely seen spa504g.cfg (IP Phone) and spa112.cfg (Cisco analog termi
by vivi_ 3mo ago
I love investigating internet background radiation, this is interesting research. I've definitely seen spa504g.cfg (IP Phone) and spa112.cfg (Cisco analog terminal adapter) before; you should actually serve these a proper config file and spin up a disposable SIP server so you can (potentially) call them on the phone, send them a fax or even better ATDT ;)
Though, come to think of it these requests are more likely from credential harvesting bots as most ITSP's provision their CPE with a <macaddr>.cfg or similar.
- racnid 3mo agoThe 00000000000.cfg stuck out to me too, because that's the default/base config name for polycom phones.
- pseudocoder204 3mo agoWere the spa504g.cfg pulls coming from the same infosec scanner IPs as everything else or from another source? Curious whether the targeted-looking requests actually separate out from the background noise.
- bediger4000 3mo agoDifferent source.