Lot of hack attempt

[AWS2P]

I've several pbx who have been targetted by lot of hack attempt (21 IP) this past night from 22:05 to 05:48, all the pbxs are with global blacklist enabled, is it something normal?
have you got same behavior this night?
example for one pbx

 

[AWS2P]

Today 24/10 it seems one of my pbx is bombarded and very strange blacklisted ips in the morning are again blacklisted at night, if they are blacklisted and global blacklist is enabled how this is possible?


Am i alone to have this behavior? Do you take care if you have like me , same IPs blacklisted more than once on your PBX?

 

[Nathan Boyd]

What is your Blacklist duration set to? I always set my instances to 31536000sec (1 Year).

 

[AWS2P]

this setting is equal to 3.17 years


nothing is released before 2022

 

[TBWD]

From this night
User-Agent: 3CXPhoneSystem (most seen)
User-Agent: Avaya (2 or 3 time)
User-Agent: Linksys-SPA942 (2 time)

I think 3cx should revoke the license to any of the systems that are involved with hack attempts, lucky for us we can block access from our router, most blocked to date "Amazon and DigitalOcean"

 

[NickD_3CX]

I think 3cx should revoke the license to any of the systems that are involved with hack attempts, lucky for us we can block access from our router, most blocked to date "Amazon and DigitalOcean"

The problem is that most of the times, the User-Agent values are deceiving, so when you see "3CXPhoneSystem", it isn't really a 3CX system on the other end...

 

[Janwillem Ronken]

We see them only from Digital Ocean, I've blacklisted now all their IP ranges (which you easily get with the following command:
whois -h whois.radb.net -- '-i origin AS14601' | grep ^route

 

[AWS2P]

My question stay un anserwered, why same IP blacklisted on morning stay able to be blacklisted at night,

Are the blacklisted IPs locally on PBXs always registered to global blacklist or may be not?