Solved Bot attack

[Soli]

Hi

There is attack on all 3CX PBX at least 1500 that we run from IP 62.72.43.115

Is it possible to auto block it in 3CX black list please?

 

[paulodagraca]

Hello soli,

If this is something you would like to share, I really would like to know.
What kind of attack did you see?
Like port 5060 flood, web 443 brute force, Tunnel 5090 DOS attack?
Also, where you able to contact [email protected] with details, so they can shutdown the compromised server?

Paulo

 

[Soli]

example from now

The IP 62.72.43.115 on PBX sclaw.3cx.eu has been blacklisted and will expire on: 2025-06-23 09:43:03.
Affected Module: Webclient / API
User agent:

Reason: Blocked for too many failed authentications

This IP Address 62.72.43.115 has made numerous attempts to authenticate with 3CX using invalid credentials. In response, 3CX has blacklisted this IP and denied any further requests.

No action is required on your behalf.

If you would like to review, edit or delete the rule, you can do so from your Management Console > Dashboard > IP Blacklist.
For more information: https://www.3cx.com/docs/allow-deny-ip-addresses/

 

[TheodorosG_3CX]

This indicate that there was a failed attempt to login to the web client.
Ensure that you have the Global Blacklist enabled in the PBX in order to add the ip to the blacklist.
Keep in mind that this Forum Section is only for security alerts regarding any alerts from EDR or Antivirus software companies.

 

[Soli]

I know but is it possible to auto block it in 3cx blacklist

 

[TheodorosG_3CX]

Since you have the option enabled this ip will be added in the global blacklist.

 

[Soli]

but it's now we continue to received this messages for 2 days

we are afraid that it will find 1 pbx with weak user password that we don't know about

In version 18 we could know that but now we cant

user can do something like Aa12345678

 

[TheodorosG_3CX]

This specific ip is in the blacklist at the moment.

 

[Soli]

Thanks

 

[TheodorosG_3CX]

As also mentioned this Forum Section is only for security alerts regarding any alerts from EDR or Antivirus software companies.
This will be marked as solved and you are always welcome to create a support ticket if needed.