gchiu: For what it's worth, I ran sipscanner on my address, and it says nothing found. Not sure why port 80 is open ... need to close it.
Any comments made are personal opinion and do not reflect directly on the position my current or past employers may have.
gchiu: Here's the first message from tcpdump:
10:38:59.926315 IP (tos 0x0, ttl 111, id 29952, offset 0, flags [none], proto UDP (17), length 795)
22.214.171.124.5070 > 192.168.1.180.5060: [udp sum ok] SIP, length: 767
INVITE sip:firstname.lastname@example.org SIP/2.0
Via: SIP/2.0/UDP 126.96.36.199:5070;branch=z9hG4bK-69ca466cab181a1529d61d41f5ac747f;rport
CSeq: 1 INVITE
Allow: INVITE, ACK, CANCEL, BYE
o=sipcli-Session 1617787993 291094220 IN IP4 188.8.131.52
c=IN IP4 184.108.40.206
m=audio 5072 RTP/AVP 18 0 8 101
By the look of that single capture it's possible it's trying to route a call to Malaysia by dialing 90060 + number (just a guess since Mayalsia is +60 as it's IDD code)
Predigits are still the norm in many places so it's trying 9 as the predigit.