Unused extensions trying to register through external IP

[Josh Busby]

Hello,

I hope this is the correct spot for this, If not my apologies.

I've noticed an increasing number of failed authentication attempts from extensions we do not use, to the same extension from our external IP. I believe this is just the anti-hacking doing it's job, but wanted to make sure.

Everything else is working fine. Just wanting to make sure there is not a bigger issue happening.

 

[leejor]

Hackers will usually choose extensions like 100, 200. or 1000, 2000, something that many PBXs will have, and hoping that the password is the same as the extension number. Some people probably do that, possibly for a test extension, that was forgotten about. They will usually try several in sequence.

In what country, is the IP , that they originate, located? If it is some place that you have never visited, let alone a possibility that someone is roaming there, then it is probably a hacker.

 

[Josh Busby]

Thanks for the info. Sounds like it is just a hacker. There are several attempts done in sequence, using different extension numbers; 78, 46, 128, etc... Did a check on the IP and found it comes from California, where we have no presence.

 

[Evolute IT]

Thanks for the info. Sounds like it is just a hacker. There are several attempts done in sequence, using different extension numbers; 78, 46, 128, etc... Did a check on the IP and found it comes from California, where we have no presence.

Not a big deal. 3CX implements Fail2Ban so the IP should get blocked after a few tries.