IP Black List

[amannick]

Hello Team

I noticed a strange thing today. I saw a Same IP address black listed on all of 3CX instance. is it something normal. I also have noted the log.

• The IP 216.245.209.190 has been blacklisted for 86400 sec. (Expires at: 2021/07/14 10:45:20). Reason: Too many failed authentications!
  SIP Server ID: 12290 07/13/2021 8:15:20 PM

SIP request (REGISTER) from 216.245.209.190 was rejected. Reason: Block WAN requests is ON. Message: REGISTER sips:3.232.109.168:5061 SIP/2.0 Via: SIP/2.0/TLS 216.245.209.190:42810;branch=z9hG4bKbfc9c19ff89322bf07032657f63a063fff0182fbde4eaf00b28f3b31e8d686 Max-Forwards: 70 Contact: 1003 <sips:[email protected]:42810> To: 1003 <sips:[email protected]:5061> From: 1003 <sips:[email protected]:5061>;tag=9c3ed251346b1627b0b624620b10a6d9 Call-ID: 87e8954541bd8f029cd068c6aaad6885 CSeq: 2 REGISTER Expires: 10000 Proxy-Authorization: Digest username="1003",realm="3CXPhoneSystem",nonce="414d535960ed7f6c77:63df0e5e5045a6337e1704e128637ee9",uri="sips:3.232.109.168:5061",response="7049821fe31ebc3d34c112377307e254",algorithm=MD5 Content-Length: 0



Can any body suggest what is it ? is it some kind of hacking attempt ?

Thanks

 

[Evolute IT]

Hello Team

I noticed a strange thing today. I saw a Same IP address black listed on all of 3CX instance. is it something normal. I also have noted the log.

• The IP 216.245.209.190 has been blacklisted for 86400 sec. (Expires at: 2021/07/14 10:45:20). Reason: Too many failed authentications!
  SIP Server ID: 12290 07/13/2021 8:15:20 PM

SIP request (REGISTER) from 216.245.209.190 was rejected. Reason: Block WAN requests is ON. Message: REGISTER sips:3.232.109.168:5061 SIP/2.0 Via: SIP/2.0/TLS 216.245.209.190:42810;branch=z9hG4bKbfc9c19ff89322bf07032657f63a063fff0182fbde4eaf00b28f3b31e8d686 Max-Forwards: 70 Contact: 1003 <sips:[email protected]:42810> To: 1003 <sips:[email protected]:5061> From: 1003 <sips:[email protected]:5061>;tag=9c3ed251346b1627b0b624620b10a6d9 Call-ID: 87e8954541bd8f029cd068c6aaad6885 CSeq: 2 REGISTER Expires: 10000 Proxy-Authorization: Digest username="1003",realm="3CXPhoneSystem",nonce="414d535960ed7f6c77:63df0e5e5045a6337e1704e128637ee9",uri="sips:3.232.109.168:5061",response="7049821fe31ebc3d34c112377307e254",algorithm=MD5 Content-Length: 0



Can any body suggest what is it ? is it some kind of hacking attempt ?

Thanks

If you have enabled the default securities and the global blacklist, you shouldn't have to worry about it.

 

[VasilisV_3CX]

Hi @amannick,

The IP reported does indeed exist within the Global Blacklist. There is nothing you need to worry about.