New Voip Wardialing Threat from "BenQ Telecom" (?)

[tel0p]

Been noticing some unknown traffic on my CDR of late. 44 calls (this month) all under 20seconds. Below is a sample of the CDR of this month (January09) with 'CHANNEL' specified as 'BenQ Telecom':

1. 2009-01-28 14:07:06     SIP/96.9.1...    BenQ Telecom      "BenQ Telecom"  s      ANSWERED      00:13
8. 2009-01-28 06:11:18     SIP/66.232...    BenQ Telecom      "BenQ Telecom"  s      ANSWERED      00:12
21. 2009-01-27 17:03:47    SIP/66.232...    BenQ Telecom      "BenQ Telecom"  s      ANSWERED      00:12

As can be seen the 'destination' is 's'. Looking at /var/log/asterisk/full I see this:

[2009-01-28 14:07:06] VERBOSE[5727] logger.c: -- Executing [9010380445945257@from-sip-external:1] NoOp("SIP/96.9.135.21-b7d102a8", "Received incoming SIP connection from unknown peer to 9010380445945257") in new stack
[2009-01-28 14:07:06] VERBOSE[5727] logger.c: -- Executing [9010380445945257@from-sip-external:2] Set("SIP/96.9.135.21-b7d102a8", "DID=9010380445945257") in new stack
[2009-01-28 14:07:06] VERBOSE[5727] logger.c: -- Executing [9010380445945257@from-sip-external:3] Goto("SIP/96.9.135.21-b7d102a8", "s|1") in new stack
[2009-01-28 14:07:06] VERBOSE[5727] logger.c:     -- Goto (from-sip-external,s,1)
[2009-01-28 14:07:06] VERBOSE[5727] logger.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/96.9.135.21-b7d102a8", "0?from-trunk|9010380445945257|1") in new stack
[2009-01-28 14:07:06] VERBOSE[5727] logger.c: -- Executing [s@from-sip-external:2] Set("SIP/96.9.135.21-b7d102a8", "TIMEOUT(absolute)=15") in new stack
[2009-01-28 14:07:06] VERBOSE[5727] logger.c:     -- Channel will hangup at 2009-01-28 22:07:21 UTC.

It shood be noted that I have 'Allow anonymous SIP calls' set to 'NO' in General Settings.
Googling really only provides results from Cisco router customer's noting similar inbound behavior on port 5060 (SIP), as seen here.

Just thought I'd post this as a starting point in case other's begin to see this behavior.

Side question: What's the easiet way to (completely) IP ban someone? iptables? easy rule? router level?

 

[TDF]

Someones just posted on the asterisk users mailing list with the same thing.