Solved SIP request (REGISTER) from external unknown IP but to multiple existing extensions...

[wmeter]

Hi,

While checking my logs I see SIP REGISTER requests from an external IP that I have nothing to do with. IP addresses that I also see in blacklists.

They are refused because the flag 'Block WAN Requests' is set, but the tries are to _existing_ numbers on my system. How can this happen ? Is it
possible to enumerate my phone numbers directly from outside w/o being authenticated ? I have a couple of extensions I use with the 3CX client on
smartphone hence I need to keep the 'Connect over WAN' possible :-(

Thanks in advance,

Willem

 

[JohnS_3CX]

Hi Willem,

Many PBXs around the world have similar internal extensions. For example my PBX has an extension 100, 200 etc. Attackers are aware of this and they often happen to try ringing extension numbers that are likely to exist.

And no, they cannot enumerate your existing extensions. They are pretty good at guessing though.

Make sure you have your Automatic Global 3CX IP Blacklist enabled in Settings > Security and sooner or later those attacker IPs will end up being banned by our defence program.


Please note however that our latest 3CX apps do NOT require you to remove this option below. You can keep it enabled and have better protection.


Latest Windows app is V16.3.0.198 and uses the 3CX tunnel, not Direct SIP or STUN.

 

[wmeter]

Many thanks John !

 

[JohnS_3CX]

Glad to help