### Description Event routes that are executed without a real SIP message available use the default "fake SIP message". The fake message has a source IPv4 address of 1.0.0.127 which belongs to CloudFlare (1.0.0.0/24).. and this led us to believe that traffic is coming from CF but could not find the messages on tcpdumps or HEP exports. Had a bit of a wild goose chase there trying to find the source. I believe the original intention has been to use 127.0.0.1 loopback address but the bytes are reversed at: https://github.com/kamailio/kamailio/blob/master/src/core/fmsg.c#L78 It would be best to change this address to well ANYTHING that doesn't imply CloudFlare is pinging you 😂 -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/3817 You are receiving this because you are subscribed to this thread. Message ID: <kamailio/kamailio/issues/3817(a)github.com>