Automatic Global 3CX IP Blacklist, cool!

[vanguard08]

I definitely like the new IP Blacklist option and certainly want to participate for the betterment of us all, but I have to ask if any other data is collected by enabling this feature?
It plainly says "IP's that are blacklisted from this instance", but it could not hurt to verify.

Thanks as always

 

[AWS2P]

Hi,
you can be happy with features but your question stay surely with no more explainations .
3cx does not disclose details about its protection by blacklistage . This is like a plane black box, only granted workers are authorised to play with.

 

[vanguard08]

Haha, maybe this is true. I figured it could not hurt to ask. Someone has to know Maybe they will answer!

 

[Mark Phillips]

All I know is that prior to the global blacklist, I was seeing lots (maybe one or two per day) of IP addresses being blocked directly on our 3CX server. Since the global blacklist was implementing, I rarely see a new IP address being blocked on our server, which must mean that they are being blocked as a result of the global blacklist...…… or else all of the hackers have given up on 3CX and are now hacking something else.

 

[AWS2P]

You can dream, i've already tried , they speak under torture only

 

[cobaltit]

All I know is that prior to the global blacklist, I was seeing lots (maybe one or two per day) of IP addresses being blocked directly on our 3CX server. Since the global blacklist was implementing, I rarely see a new IP address being blocked on our server, which must mean that they are being blocked as a result of the global blacklist...…… or else all of the hackers have given up on 3CX and are now hacking something else.

For the most part, hackers aren't targeting 3CX. They are simply scanning entire netblocks for common open ports like 5060, and then based on the results, running follow-up scripts that test common credentials like extension 100, password 100.

 

[vanguard08]

Yea fair enough. I can't argue with @cobaltit .Most of that can be stopped by Firewalls. My issue is not what good it does, like I said... I love the idea, and love participating in community security. You scratch my IPs, and I'll scratch yours. I just live in the paranoid world and have to answer to even more paranoid people. We live in a data collection world where "big data" is King lol. I would just like to know if by releasing those IP addresses... that's all I'm agreeing to release.

 

[Mark Phillips]

For the most part, hackers aren't targeting 3CX. They are simply scanning entire netblocks for common open ports like 5060, and then based on the results, running follow-up scripts that test common credentials like extension 100, password 100.

True.

 

[DSXVOICE]

We were surprised to discover that a huge percentage of SIP hacking comes from just one network - PoneyTelecom. Its the homebase for hackers and hacker-bots. We run the following script in our standard cron jobs to make sure PoneyTelecom is blocked on all ports and not accidentally or otherwise allowed. Its brutal and broad, but its been necessary. Proactively block these guys and you will save yourself a lot of misery.

# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# PoneyTelcom
# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
if ! iptables -L -n | grep '51.15.0.0' ; then
sudo iptables -I INPUT -s 51.15.0.0/16 -j DROP
sudo iptables -I INPUT -s 163.172.0.0/16 -j DROP
sudo iptables -I INPUT -s 62.4.0.0/16 -j DROP
sudo iptables -I INPUT -s 195.154.0.0/16 -j DROP
sudo iptables -I INPUT -s 62.210.0.0/16 -j DROP
sudo iptables -I INPUT -s 212.0.0.0/8 -j DROP
sudo iptables -I INPUT -s 198.23.255.226 -j DROP
sudo iptables -I INPUT -s 151.115.0.0/16 -j DROP
fi
# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# End
# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^