Port 5060 (SIP)

Session Initiation Protocol for VoIP calls (TLS on 5061).

Transport: TCP/UDP
Internet exposure: Restrict

Expose only to specific networks, or behind a VPN.

Security notes

Exposed SIP is scanned constantly for weak extensions to commit toll fraud.

When it shows up in your logs

Registration attempts for many extensions from one IP is SIP brute forcing.

5061