Unknown Blank User 1001

[danhole]

I have noticed a new blank user on my system with extn 1001.
I'm trying to find out how this got there, as it has no first name or last name.
I'm the only one with access to create users, so I know this wasnt something we have set up.
Searching the activity log for 1001 shows the following: is there anywhere else I can check?
Could the system be compromised?

15/07/2025 23:00:01.416	Extn:1001: Synch devices to dndOFF
15/07/2025 23:00:01.087	Settings of Extn:1001 has been updated
15/07/2025 23:00:01.086	Extn:1001: Starting DND change transaction to dndOFF requested from configuration
15/07/2025 23:00:01.086	Extn:1001: Profile is set to dndOFF
15/07/2025 23:00:01.086	Extn:1001 belongs to groups 53,
15/07/2025 23:00:01.084	DN:1001 belong to groups: 53{GRP2},, primary group: 'GRP2'
15/07/2025 23:00:01.083	Extn:1001 belongs to groups [53{GRP2},]
15/07/2025 23:00:01.082	Updating groups membership for DN:1001

 

[Alphabetic]

whats in the audit logs

 

[danhole]

nothing detailing this extn
just the normal web client logins

 

[PhoneMan123]

Do you have O365 integration enabled? It will create new users if the emails don't match from the original and whats in O365.

 

[danhole]

I do, but it doesn't show an email or any user details

 

[KyriacosS_3CX]

Hi,

Can we check if O365 has a matching phantom user? I understand it shouldn't be able to have a nameles, emailless user, but just in case.

 

[KyriacosS_3CX]

Any chance this was a proper user that got Cleared (accident or on purpose) at some point:



Should come up in activity log:

 

[danhole]

ive checked 365 and there are no users, again I'm the only admin and haven't changed anything in 365.
our extn's start at 6001 so i know it wasn't an existing one which got cleared.

 

[KyriacosS_3CX]

On a 4 digit system 1001 could have been something that was added on initial install, but yes, normally that would have always been visible.
Some system extension, bridge, IVR etc that got recently modified?
Any experiments with the API that might have resulted in a spurious extension showing up?

Is there any further activity in the logs from this extension? Does the dnd change setting time, group references etc match anything you would expect to see coming from 365?

 

[SteveITS]

What happened at 15/07/2025 23:00, that (on the hour) seems very specific as upgrades are a bit more random during the allotted hour.

If you delete it and it comes back then it's being sync'd in, but then of course you've deleted it in the meantime.