A peer-to-peer SIP honeypot and fraud detection tool that collects and shares malicious IP addresses and phone numbers.
SentryPeer is a fraud detection tool that acts as a SIP honeypot to collect malicious IP addresses and phone numbers from attackers probing VoIP systems. It enables users to share this data via a peer-to-peer network, providing a decentralized threat intelligence platform for SIP server protection. The tool helps prevent voicemail fraud, credential theft, and expensive call scams by alerting administrators to known bad actors.
VoIP administrators, telecom service providers, and security professionals running SIP servers (e.g., PBX systems like FreeSWITCH, Asterisk) who need to detect and block fraudulent activity. It is also suitable for honeypot enthusiasts and those interested in decentralized security data sharing.
Developers choose SentryPeer because it offers a decentralized, user-owned alternative to centralized fraud detection services, ensuring data privacy and control. Its peer-to-peer sharing model, combined with local storage and a rich API, provides real-time threat intelligence without vendor lock-in.
Protect your SIP Servers from bad actors at https://sentrypeer.org
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses OpenDHT for opt-in peer-to-peer sharing, allowing users to control and own their collected data while benefiting from community intelligence, as emphasized in the philosophy section.
Stores events in a local SQLite database or JSON logs with a RESTful API for quick queries, enabling real-time integration with PBX/ITSP systems to check for known bad actors.
Supports WebHook integration (including SentryPeerHQ), Fail2ban via syslog output, and Docker deployment, making it adaptable to various monitoring and blocking workflows.
Handles UDP, TCP, and TLS for SIP communication, ensuring compatibility with different network configurations and security needs, as listed in the features.
The README marks key features like IPSET API and BGP agent for blackholing as TODO items, limiting advanced, automated firewall integration without custom development.
Building from source requires installing numerous libraries (e.g., libosip2, libsqlite3, OpenDHT, Rust) across different platforms, which can be error-prone and time-consuming.
Focused solely on SIP fraud detection via honeypot responses, so it's ineffective for broader network security or non-VoIP threat monitoring without significant adaptation.