Well as of this morning, I can confirm that attacks from Amazon continue. We saw a compromise of an extension that originated from EC-2 (79.125.71.218). The successful authentication to the system was at 10:58am EST on 5/15/10.

What is interesting is that this system was not used to make any calls – instead they originated from another IP, based out of Germany. This other IP (91.194.85.241) also appeared to be brute forcing as the client was ‘friendly scanner’, which is sipvicious from what I can see.

We reported both to the related abuse contacts, but like other submissions, I don’t expect a lot of response.

I hope that Amazon is actively working on these – I recognize the challenge they have given the number of systems they manage. But active cooperation and protactive monitoring for abnormal traffic seem to be an obvious necessity if one is to run a system like they do.

You never said anything about asking about accounts, that was just yanked out of the depths of.. well you know Matt…

Also, Segedunum sounds like some Amazon employee trying to protect their interest. I’m not saying directly he/she is but come on read your own comments, nearly everything you said was pulled out of no where and not even one thing was accurate.

If you are going to attack what Fred is doing, at least get the facts right. Otherwise you look like a douchebag.

Keep up the good work Fred.