Keep getting this type of stuff my logs

[tspjoker]

• User or password is invalid from 174.138.6.8. (User: 432, password: Adm1n432)
  3CX Phone System Management Console ID: 30037 01/26/2023 2:33:55 PM
• User or password is invalid from 174.138.6.8. (User: 432, password: Admin432)
  3CX Phone System Management Console ID: 30037 01/26/2023 1:54:30 PM
• User or password is invalid from 103.16.199.166. (User: 547, password: password)
  3CX Phone System Management Console ID: 30037 01/26/2023 12:51:33 PM
• User or password is invalid from 178.79.180.221. (User: admin, password: AdMiN)
  3CX Phone System Management Console ID: 30037 01/26/2023 12:50:16 PM
• User or password is invalid from 176.58.125.165. (User: 205, password: 205205)
  3CX Phone System Management Console ID: 30037 01/26/2023 12:48:46 PM
• User or password is invalid from 174.138.6.8. (User: 321, password: Admin321)
  3CX Phone System Management Console ID: 30037 01/26/2023 12:35:58 PM
• User or password is invalid from 128.199.143.141. (User: 556, password: password)
  3CX Phone System Management Console ID: 30037 01/26/2023 12:33:49 PM
• User or password is invalid from 192.252.216.81. (User: 554, password: password)
  3CX Phone System Management Console ID: 30037 01/26/2023 12:11:56 PM
• User or password is invalid from 5.189.159.215. (User: 557, password: password)
  3CX Phone System Management Console ID: 30037 01/26/2023 12:01:00 PM
• User or password is invalid from 198.74.58.55. (User: 553, password: password)
  3CX Phone System Management Console ID: 30037 01/26/2023 10:43:43 AM
• User or password is invalid from 47.101.220.176. (User: 503, password: password)

so idk this is normal for you guys my blacklist has 365 IP addresses that try to into my cloud server,
i have questions for you guys, is that normal to everyone??? or just me? also is it anything i can stop getting this type of
random IP?? if anybody give me a good recommendation, i will appreciate.

 

[SteveITS]

In Security/Anti-Hacking do you have the global blacklist enabled? If you are 3CX hosted though I thought that was on by default.

 

[tspjoker]

ikr that's what i thought too. but apparently it doest do anything XD idk lol

 

[tspjoker]

In Security/Anti-Hacking do you have the global blacklist enabled? If you are 3CX hosted though I thought that was on by default.

so I double check security anti-hacking and it is set as default and it doesn't seem to work as intended to be... that is why I was asking if some people have an exactly similar issue or only just me??? and is it any other way to fix this problem? so i don't need consistently type each IP address all day....as you know ..

 

[Alphabetic]

ikr that's what i thought too. but apparently it doest do anything XD idk lol

All that option does it add blacklists to your instance based on data gathered throughout the 3CX network who have this option enabled too.

You should leave your anti-hacking settings as default to be effective and change your console restrictions to specific IP addresses only.

As i've said time and time again, anything on the internet is subject to attempted attacks and it will happen.

 

[SteveITS]

or only just me?

Others have posted before so no it's not you. We do our own hosting for clients, and have geographically-limited access rules for 3CX, and IDS in front of all servers in our data center, so rarely see block alerts. 3CX can't really do that since they need the world to access servers they host.

 

[tspjoker]

All that option does it add blacklists to your instance based on data gathered throughout the 3CX network who have this option enabled too.

You should leave your anti-hacking settings as default to be effective and change your console restrictions to specific IP addresses only.

As i've said time and time again, anything on the internet is subject to attempted attacks and it will happen.

so you mean all those numbers and anything should be set as a?? default ?????

 

[SteveITS]

Is Security/Console Restrictions visible to you? If so you can set "Allow Access from specific IP Addresses" and add your IP(s). That affects the management console not the web client.

 

[tspjoker]

Is Security/Console Restrictions visible to you? If so you can set "Allow Access from specific IP Addresses" and add your IP(s). That affects the management console not the web client.

no. someone said hosted 3cx does not have that options .???

 

[SteveITS]

no. someone said hosted 3cx does not have that options

I did not think so but thought I'd ask. Presumably, they won't want people locking themselves out all the time. I mean, a 1% chance per year is low but for [made up number] 100,000 servers that's 1000 a year.

 

[tspjoker]

I did not think so but thought I'd ask. Presumably, they won't want people locking themselves out all the time. I mean, a 1% chance per year is low but for [made up number] 100,000 servers that's 1000 a year.

ok so, i guess something wrong with my hosted server...i wonder why...i kept getting this stupid random iP address from anywhere...is it any 3cx guy who can help me out with this?

 

[SweetAction]

Nothing is wrong with your hosted server - this is common that anything public facing is attacked. All that changed here is that 3CX just turned on seeing it in the logs by default.

Your options are:
1. Self host / public cloud and lock down the firewall
2. Move to StartUP and let 3CX worry about it
3. Continue worrying about it

As long as your security settings are the default or stronger and your passwords are strong (anything 3CX generates would be considered strong), you will be fine.

 

[tspjoker]

Nothing is wrong with your hosted server - this is common that anything public facing is attacked. All that changed here is that 3CX just turned on seeing it in the logs by default.

Your options are:
1. Self host / public cloud and lock down the firewall
2. Move to StartUP and let 3CX worry about it
3. Continue worrying about it

As long as your security settings are the default or stronger and your passwords are strong (anything 3CX generates would be considered strong), you will be fine.

sounds like your given a very good option obviously i got nothing worry about as you said until i got hacked lol. fair enough. thanks for your advice