License Limit Reached

[infinty.tech]

Hi,

I had a very strange situation that happend at one of my client about 30 minutes ago,

I have recieved an email from the 3cx that tell me the following;

Your 3CX license limit has been reached. This means that you cannot make any more calls at this time.
Active calls: [2687,2688,2689,2690,2691,2692,2693,2694,2695,2696,2697,2698,2699,2700,2701,2702,2703,2704]

I'm using the 3cx smtp so the email originated from [email protected]

My extension ranges are from 1xx to 5xx, so I immediately begin to think sh!t i'm being hacked, so I disconnect the server from internet and begin to look in the call logs, and event log, but I cannot find anything that will relate of point in the direction that those extension made a call or registration request or that i'm being hacked.

Details of the installation,

276 extension
we are using voip ( so the ports are open)
version: 16.0.641
all the extesions have the Disallow use of extension outside the LAN enable

 

[cobaltit]

Those aren't extension ranges. Those are call numbers. Activity log, filter by call and use one of those numbers as a starting point.

 

[nub]

"Code red" is a service that many cities use, to tell you trash pickup is going to be late. I block the numbers for them that I find and that stops this for the most part.

 

[JohnS_3CX]

Look at what @cobaltit said, and you can find out what those calls were.

Once you know who called who you can then act accordingly

 

[infinty.tech]

Those aren't extension ranges. Those are call numbers. Activity log, filter by call and use one of those numbers as a starting point.

Hi Cobaltit,

Thank you for you reply, in the activity log I don't get nothing, and on the call log when i filter for those numbers I don't get anything

This is a very very strange situation

 

[nub]

look in the call log for something like this:

 

[NickD_3CX]

What @cobaltit means is in your Management Console go to Dashboard --> Activity Log, and here press the "Filter" button, then you can search there for this CallIDs.

Also because they are sequencial, I do not suspect any "stuck" call in the system, but I would lean towards:

• The obvious - There were actually this many calls being made
• You have some kind of logical "loop" that causes this. A case I had seen once is a DID, going to a Queue, no agents logged in, forward to exernal number, and the external number was another DID pointing to the same Queue.