3CX blacklist IP

[AW Holding IT]

Dears,

Greetings!

I need help with this situation as I found every day a log from 3CX "The IP 156.175.252.158 has been blacklisted for 900 sec. (Expires at: 2023-12-06 23:08:07). Reason: 3CX Clients / Softphones blocked - 3CX API Component"

I found that different IPs failed to authenticate with the 3CX system

but no one in my organization till he faced an issue logging on to 3CX.
and also we using integration with Microsoft to log in to the 3CX system.

now how I can know the extension that the IPS tries to log on with?

and how to secure 3CX from the attacks as I suppose this is a try to attack the system.

I already configured the "Automatic global 3CX Blacklist".

 

[SteveITS]

That IP is in Egypt, is that expected? If not then it's just a random hack attempt and you can ignore it since the anti-hacking is doing its job.