Blacklisted IPs - Can we see the username attempted?

[jpercival]

Is there a way to be made aware which account/username is being used during the attempted logons? The VAST majority of these logons are random out-of-country hackers from 6 or 7 different countries a week, but it would be kind of nice to know which ones are users that are accidentally locking themselves out.

 

[AWS2P]

did you enabled global blacklist in PBX ?
As far as I know there 's no way to have other things than IPs, but if they are local could be easy to see IPs from same LAN, now for sure if it's a lock from out of office then , end of party.

 

[jpercival]

Global blacklist is enabled, yes.

 

[cobaltit]

Not in the blacklist itself. I believe you will see the failed attempts in the logging if it's set to verbose.

 

[jpercival]

Excellent to know. Thank you, everyone!

 

[leejor]

I don't think Verbose is even necessary. With logs set to the default i can see the extension they are attempting to register and/or the numbers they are attempting to dial with a direct SIP call. Of course it means you need to go back through the Activity Logs to the time shown on the email notification.