Anonymous 
Every public SIP port on the internet is being knocked on right now. Not by people who want to call you, but by scripts looking for a weak extension password, an open dial plan, or a PBX that will happily route a few thousand minutes of international traffic on someone else’s bill. Toll fraud is still one of the most profitable low-effort attacks out there, and the recon never stops.
So we’re publishing what our firewall sees. The BSI VoIP Hacker IP Blocklist is a free, plain-text list of IP addresses caught attacking VoIP services at the Binary Systems edge. As of October 28, 2026, it holds 639 entries: 634 IPv4 and 5 IPv6.
What’s on the list
Each entry is a public address our firewall logged scanning, brute-forcing or flooding VoIP services: SIP on UDP/TCP 5060 and 5061, IAX2 on UDP 4569, and RTP media ports. The pattern is familiar to anyone who has run a PBX on a public IP: a stream of SIP OPTIONS probes to fingerprint the box, sometimes thousands of packets an hour from a single source, and on a vulnerable system, REGISTER attempts that try extension numbers and common passwords.
Those sources also rotate. Recently we’ve seen SIP probes move to a new address in the same cloud provider’s range after the old one was blocked. A shared list helps close that gap faster than any single box can on its own.
How it’s maintained
The list is curated, not just dumped from a log. New attackers are added as our monitoring flags them. Before anything ships, the list is scrubbed of search-engine crawlers and of legitimate VoIP peers such as carriers and trunk providers, because blocking your own upstream is the fastest way to turn a security fix into an outage. Addresses found to be legitimate are removed. The goal is a list you can actually put in front of production traffic.
How to use it
The raw list lives at VoIP-Blacklist.txt. It holds one IPv4 or IPv6 address or CIDR range per line, and lines starting with # are comments.
OPNsense or pfSense. Create a URL Table (IPs) alias pointing at the download link with a daily refresh. Use it as the source in a WAN block rule placed above your SIP port forwards. If you forward 5060 to a PBX, make sure the block actually applies to forwarded traffic, not just traffic to the firewall itself.
Linux with ipset and iptables. Load the list into a set and drop it at the edge:
ipset create voip-bl hash:net -exist curl -s https://www.binary-systems.com/voip-blocklist/VoIP-Blacklist.txt \ | grep -v '^#' | grep -v : \ | while read ip; do ipset add voip-bl "$ip" -exist; done iptables -I INPUT -m set --match-set voip-bl src -j DROP
That snippet handles IPv4. For the IPv6 entries, create a second set with family inet6 and match it with ip6tables.
Asterisk and FreePBX. Asterisk itself shouldn’t be your packet filter. Push the list into the host firewall as above, or into the FreePBX firewall’s blacklist. Keep fail2ban watching your Asterisk security log for the attackers who aren’t on anyone’s list yet.
fail2ban. Treat the list as a pre-loaded, long-lived ban set alongside your existing asterisk jail. The list stops the known offenders up front, and fail2ban catches the new ones.
Refresh no more than once a day. The list doesn’t change faster than that, and there’s no reason to hammer the server.
Fair use and no warranty
The list is free to use, provided as-is, with no warranty of any kind. You’re responsible for what you block. Test it before you put it in front of production traffic, and always allow your own carriers, trunk providers and remote sites explicitly, above any blocklist rule. A blocklist is one layer. Strong SIP passwords, restricted dial plans, and limiting registration to the networks that need it still do the heavy lifting.
Think you’re listed by mistake?
False positives happen, especially on shared cloud and NAT addresses. If an address you control is on the list and shouldn’t be, contact Binary Systems through binary-systems.com with the IP address, roughly when you were blocked, and what service you run. We’ll review it, and if the traffic was legitimate, the address comes off the list.
Stay patched, keep your SIP passwords long, and stop handing your PBX to strangers.
— Anonymous
