SIP Server

Management Console

SIP Server

  • Dashboard
  • Blocklist
  • Whitelist
  • Logs
  • Abuse Reports
  • Export
  • Settings
  • Users

Dashboard

Total Attacks

-

Last 24 Hours

-

Unique IPs

-

Blocked IPs

-

Time Wasted 💨

-

Live Attack Map

Attack Origin Call Destination

Active Tarpit Sessions 0

Real-time view of attackers being tarpitted (wasting their time/resources) and ripping ass 💨

IP Address Target Phase Progress Duration

No active tarpit sessions

Top Attacking IPs

IP AddressAttemptsAction

Attack Methods

MethodCount

Top Call Destinations 📞

CountryCalls

Geographic Analytics

Attacks by Country

CountryUnique IPsAttacks

Attacks by ASN

ASNNameIPsAttacks

Blocked IPs

Public Blocklists

These URLs can be used by firewalls and security tools to automatically fetch the blocklist:

  • All IPs (JSON): /api/public/blocklist
  • All IPs (Text): /api/public/blocklist.txt
  • IPv4 Only: /api/public/blocklist-ipv4.txt
  • IPv6 Only: /api/public/blocklist-ipv6.txt
  • MikroTik RSC: /api/public/mikrotik.rsc (?list=name&timeout=HH:MM:SS)
  • Cloudflare: /api/public/cloudflare.txt (IP/CIDR only, no comments)

External Blocklist Sources

Import IPs from public threat intelligence feeds (APIBAN, CrowdSec, OpenDBL) and custom URL lists.

Add Custom URL List

Add any URL that serves a plain text IP list (one IP/CIDR per line).

IP Address Source Reason First Seen Last Seen Hits Actions

Whitelisted IPs

IP Address Description Added By Created Actions

Honeypot Logs

Time Source IP Port Protocol Method Dest URI User Agent Actions

Export Blocklist

Juniper Router Export


                        

                    

                


                
                

                    
Abuse Reports


                    

                        
Send Abuse Report

                        
Enter an IP address to look up its abuse contact and send a report.

                        

                            

                                
                                
                            

                            

                                
                            

                        

                    


                    

                        
Blocked Abuse Emails

                        
Emails in this list won't receive abuse reports (e.g., IANA, invalid contacts).

                        

                            
                            
                            
                        

                        

                            
                                

                                    Email
                                    Reason
                                    Added By
                                    Date
                                    Actions
                                

                            
                            
                        

                    


                    

                        
Report History

                        

                            
                                

                                    Date
                                    IP Address
                                    Abuse Contact
                                    Organization
                                    Attacks
                                    Status
                                    Actions
                                

                            
                            
                        

                    

                


                
                

                    
Settings


                    

                        
SMTP Configuration

                        
Configure SMTP settings for sending abuse reports to network operators.

                        

                            

                                

                                    
                                    
                                

                                

                                    
                                    
                                

                            

                            

                                

                                    
                                    
                                

                                

                                    
                                    
                                

                            

                            

                                
                                
                            

                            

                                
                                
                            

                            

                                
                                
                            

                        

                    


                    

                        
Abuse Reporting

                        

                            
                            
                            
Minimum days between sending reports for the same IP address.

                        

                        

                            
                            
                            
Your organization name used in report emails.

                        

                        

                            
                            
                            
Opening line of the abuse report email. Leave blank to auto-generate from org name.

                        

                        

                            
                            
                            
Subject line prefix. The attacker IP will be appended automatically.

                        

                    


                    

                        
Honeypot Settings

                        

                            
                            
                            
Number of attack attempts before automatically blocking an IP.

                        

                        

                            
                            
                            
Days before blocked IPs expire and are removed from the blocklist.

                        

                    


                    

                        
SIP Tarpit

                        
Tarpit wastes attacker resources by sending endless 180 Ringing responses to INVITE requests, tying up their scanner.

                        

                            
                        

                        

                            
                            
When enabled, only IPs that are already blocked will be tarpitted. Disable to tarpit all INVITE requests.

                        

                        

                            
                            
When enabled, sends hilarious fart sounds via RTP to attackers during the fake call phase.

                        

                        

                            

                                
                                
                            

                            

                                
                                
                            

                        

                        

                            

                                
                                
                            

                            

                                
                                
                            

                        

                        
After ringing, the call is "answered" and held open for a random duration between min and max.

                    


                    

                        
Rate Limiting / Throttling

                        
Limit responses and log entries per IP to prevent resource exhaustion from aggressive scanners.


                        
Response Throttling

                        

                            
                            
Stop responding after an IP exceeds the request limit. They still get logged (subject to log throttling).

                        

                        

                            
                            
                            
Set to 0 for unlimited. Default: 30 responses/minute per IP.

                        


                        
Log Throttling

                        

                            
                            
Limit database writes per IP to prevent log flooding. IPs are still blocked even when logs are throttled.

                        

                        

                            
                            
                            
Set to 0 for unlimited. Default: 10 log entries/minute per IP.

                        


                        
Credential Brute Force Protection

                        

                            
                            
Auto-block IPs that send too many credential attempts in a short time window.

                        

                        

                            
                            
                            
Number of credential attempts before auto-blocking. Default: 5 attempts.

                        

                        

                            
                            
                            
Time window for counting credential attempts. Default: 60 seconds.

                        

                    


                    

                        
                        
                    

                


                
                

                    
User Management

                    

                        
                    

                    

                        
                            

                                Username
                                Email
                                Role
                                Last Login
                                Status
                                Actions