Asterisk log with so many non-existent user authenticating

AllStarLink
1

Setup Information

ASL3 Version: 3.x.y

too many non existent user filling up the log

[2026-07-24 08:16:17.635] NOTICE[653407] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:16:17.635] NOTICE[653407] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:16:25.658] NOTICE[653410] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:16:25.658] NOTICE[653410] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:16:33.580] NOTICE[653411] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:16:33.580] NOTICE[653411] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:16:41.165] NOTICE[653414] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:16:41.165] NOTICE[653414] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:16:49.395] NOTICE[653421] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:16:49.395] NOTICE[653421] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:16:57.283] NOTICE[653426] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:16:57.283] NOTICE[653426] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:17:05.348] NOTICE[653431] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:17:05.348] NOTICE[653431] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:17:13.630] NOTICE[653432] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:17:13.631] NOTICE[653432] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:17:21.652] NOTICE[653436] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:17:21.652] NOTICE[653436] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:17:29.878] NOTICE[653439] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:17:29.878] NOTICE[653439] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:17:37.881] NOTICE[653440] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:17:37.881] NOTICE[653440] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:17:46.247] NOTICE[653443] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:17:46.247] NOTICE[653443] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:17:54.270] NOTICE[653448] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:17:54.270] NOTICE[653448] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:18:01.903] NOTICE[653449] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:18:01.903] NOTICE[653449] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:18:09.688] NOTICE[653450] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:18:09.688] NOTICE[653450] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:18:17.498] NOTICE[653451] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:18:17.498] NOTICE[653451] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:18:22.785] NOTICE[653454] manager.c: 45.61.187.141 tried to authenticate with nonexistent user 'phpconfig'
[2026-07-24 08:18:22.785] NOTICE[653454] manager.c: 45.61.187.141 failed to authenticate as 'phpconfig'
[2026-07-24 08:18:25.982] NOTICE[653457] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:18:25.982] NOTICE[653457] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:18:34.201] NOTICE[653460] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:18:34.201] NOTICE[653460] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:18:42.178] NOTICE[653463] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:18:42.178] NOTICE[653463] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:18:50.202] NOTICE[653464] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:18:50.202] NOTICE[653464] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:18:58.396] NOTICE[653470] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:18:58.396] NOTICE[653470] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:19:06.538] NOTICE[653471] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:19:06.538] NOTICE[653471] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:19:14.292] NOTICE[653481] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:19:14.292] NOTICE[653481] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:19:22.229] NOTICE[653486] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:19:22.229] NOTICE[653486] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:19:30.183] NOTICE[653487] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:19:30.183] NOTICE[653487] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:19:38.370] NOTICE[653490] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:19:38.370] NOTICE[653490] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:19:46.493] NOTICE[653491] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:19:46.493] NOTICE[653491] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:19:54.126] NOTICE[653494] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:19:54.126] NOTICE[653494] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:20:02.345] NOTICE[653496] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:20:02.345] NOTICE[653496] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:20:10.044] NOTICE[653498] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:20:10.044] NOTICE[653498] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:20:18.121] NOTICE[653499] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:20:18.121] NOTICE[653499] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:20:25.934] NOTICE[653505] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:20:25.934] NOTICE[653505] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:20:33.677] NOTICE[653510] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:20:33.677] NOTICE[653510] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:20:41.478] NOTICE[653511] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:20:41.478] NOTICE[653511] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:20:49.722] NOTICE[653512] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:20:49.722] NOTICE[653512] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:20:57.721] NOTICE[653517] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:20:57.721] NOTICE[653517] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:21:06.025] NOTICE[653521] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:21:06.025] NOTICE[653521] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:21:13.884] NOTICE[653523] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:21:13.884] NOTICE[653523] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:21:21.834] NOTICE[653528] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:21:21.834] NOTICE[653528] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:21:29.910] NOTICE[653531] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:21:29.910] NOTICE[653531] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:21:37.825] NOTICE[653534] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:21:37.825] NOTICE[653534] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:21:45.711] NOTICE[653535] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:21:45.711] NOTICE[653535] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:21:53.340] NOTICE[653540] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:21:53.340] NOTICE[653540] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:22:01.421] NOTICE[653541] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:22:01.421] NOTICE[653541] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:22:09.693] NOTICE[653542] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:22:09.693] NOTICE[653542] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:22:17.747] NOTICE[653543] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:22:17.747] NOTICE[653543] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:22:25.369] NOTICE[653548] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:22:25.369] NOTICE[653548] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:22:33.340] NOTICE[653555] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:22:33.340] NOTICE[653555] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:22:41.244] NOTICE[653558] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:22:41.244] NOTICE[653558] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:22:49.310] NOTICE[653561] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:22:49.310] NOTICE[653561] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:22:57.631] NOTICE[653566] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:22:57.631] NOTICE[653566] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:23:05.980] NOTICE[653569] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:23:05.980] NOTICE[653569] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:23:13.905] NOTICE[653572] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:23:13.905] NOTICE[653572] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:23:21.654] NOTICE[653576] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:23:21.654] NOTICE[653576] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:23:29.627] NOTICE[653579] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:23:29.627] NOTICE[653579] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:23:38.169] NOTICE[653582] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:23:38.169] NOTICE[653582] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:23:46.359] NOTICE[653583] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:23:46.359] NOTICE[653583] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:23:54.037] NOTICE[653586] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:23:54.037] NOTICE[653586] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:24:01.984] NOTICE[653590] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:24:01.984] NOTICE[653590] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:24:10.059] NOTICE[653593] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:24:10.059] NOTICE[653593] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:24:17.771] NOTICE[653594] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:24:17.771] NOTICE[653594] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:24:25.967] NOTICE[653601] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:24:25.967] NOTICE[653601] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:24:34.230] NOTICE[653602] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:24:34.230] NOTICE[653602] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:24:42.086] NOTICE[653603] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:24:42.086] NOTICE[653603] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:24:49.845] NOTICE[653604] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:24:49.845] NOTICE[653604] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:24:57.955] NOTICE[653608] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:24:57.955] NOTICE[653608] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:25:05.844] NOTICE[653609] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:25:05.844] NOTICE[653609] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:25:13.545] NOTICE[653610] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:25:13.545] NOTICE[653610] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:25:21.845] NOTICE[653617] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:25:21.845] NOTICE[653617] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:25:30.031] NOTICE[653618] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:25:30.031] NOTICE[653618] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:25:37.694] NOTICE[653619] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:25:37.694] NOTICE[653619] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:25:45.916] NOTICE[653622] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:25:45.916] NOTICE[653622] manager.c: 148.240.238.3 failed to authenticate as 'callback'
[2026-07-24 08:25:54.389] NOTICE[653625] manager.c: 148.240.238.3 tried to authenticate with nonexistent user 'callback'
[2026-07-24 08:25:54.389] NOTICE[653625] manager.c: 148.240.238.3 failed to authenticate as 'callback'

2

Why do you have your manager port exposed to the world? That's your problem. If you want an external mon of some sort to monitor your node, firewall it such that only that machine is allowed to get packets from your manager port. There is absolutely no reason for that to be completely exposed like that.

3

I know its my PROBLEM DUH!!! I just want to know why. Since on my 2 other server an ASL 2.0 in which my manager.conf port is also open, but I don't this kind of nonexistent user authentication. I observe this only on all my ASL 3.0 server hosted on different cloud VPS.

Anyway, thanks for you suggestion.

4

It's probably always been happening and ASL2 didn't log it. It's "normal" probing from malicious actors all over the Internet. It's just like all the crap that gets thrown at your webserver.

5

Luck of the draw. Someone scanned an IP range, found an open Asterisk manager port and is now having fun. Bottom line, don't ever expose your manager port to the world. With good firewall practices, there is no need for it, even if you want other systems to have access to manager. I use a VPN for that sort of thing, so there is no chance of it ever hitting the public internet. Manager is only bound to the VPN interface and localhost.

6

Here's what gets me as someone who deals with this type of stuff at a higher level.

It is the same IP. Most things that are scanning for exploits will give up after it fails a couple of times. I will see all kinds of login attempts for all kinds of various logins...and it's usually 4 or 5 attempts at most before they cycle to another IP. The VoIP servers I manage get their door beat on allllll the time....the nature of having anything on port 5060. But that's also the thing...most attacks are hitting the SIP side on 5060....I haven't seen many focuson AMI

The IP is also out of Mexico. I haven't seen a lot of activity coming out of there against VoIP servers. You didn't mention if you have this running at home or on a VPS in a datacenter. If it's at your home then there's a chance you just got on to an IP that happened to have an AMI on it. Crazy....but I'm only going that route because I've never seen a failed login attempt that many times. The script kiddies have slightly smarter scripts than that.

But the other thing like everyone said is the AMI port shouldn't be open...which is why I'm wondering if you're hosting in a datacenter with a misconfigured firewall. You have to usually do some work to open the AMI port. IF you didn't...and your AMI port is open...then you're missing a firewall.

I'll pull a copy of Kali later and see if they've added some new tools or if sipvicious has added ami attacks.