It's a fairly common problem unfortunately. Most of the attacks I've experienced have been directed at known ports used by popular control panels (like Plesk, C

It's a fairly common problem unfortunately. Most of the attacks I've experienced have been directed at known ports used by popular control panels (like Plesk, CPanel, etc), they typically hit those ports with brute force attacks, trying to crack admin passwords and such...and yes these attacks can happen only minutes after you create the server. I wouldn't be surprised if Asterisk is on their list. Even if it's a one in a million chance, it's worth it for them to try. Remember there are only 4 billion or so ipv4 addresses. That's trivial for a serious botnet to scan repeatedly. They hit the ports looking for live ones, and if they catch a bite they double-down on that machine and flood it with attacks. Ipv6 is of course, many orders of magnitude harder for them to fish for. But as far as best practices go... you just can't be too careful. Keep machines behind a firewall until they're ready to be exposed to the public (if at all). Using non-standard ports doesn't hurt either.