Warning 30051 "Unidentified Incoming Call" appearing on all our 3CX systems

[N-AGPRO]

Hello,

We are regularly seeing warning 30051 "Unidentified Incoming Call" in the event log on several of our 3CX systems.

Warning description: Unidentified incoming call. Please review the INVITE and adjust the source identification.

This warning appears repeatedly in the logs, without any visible impact on operation.

We would like to know: Is this simply due to external SIP scan attempts being blocked by 3CX?

Or could it indicate a configuration issue at the trunk level (source identification, IP address, etc.)?

And most importantly, is there a recommended method to prevent this warning from appearing in the logs?

Thank you in advance for your feedback and recommendations !

 

[AbdullaR_3CX]

Hello @N-AGPRO
The warnings you are seeing (30051) are typically caused by spoofed calls. These calls are automatically blocked by 3CX, which is why they do not impact the normal operation of your system.

It is very likely that these are not legitimate calls, but rather external SIP scan or spoof attempts. This behavior is a security measure implemented to protect the PBX, and it cannot be modified or disabled.

In short, seeing these warnings in the logs is normal when the system is actively protecting itself from unauthorized or spoofed call attempts.

 

[bitn2]

And most importantly, is there a recommended method to prevent this warning from appearing in the logs

You can limit your sip port to the network of your sip provider. Thats what we are doing with most of ouer customers.

 

[leejor]

Scammers/hackers will scan for a PBX port (Usually 5060, but others as well), when they find one they will try to either register an extension, or place calls. Because they only have your public IP and not your FQDN to use, when they attempt a call, they will be immediately blocked by 3CX. Of course there are other security measures in place as well. But trying to use your IP in the INVITE is a non-starter. We've all been dealing with this for years.

 

[alexeis6]

HI@bitn2
I have same issue but is only happening in my SBC remote Office and I did blacklist the incoming public IP not recognized by me or 3cx system and that IP still trying to log in with extension numbers marked as Unidentified Incoming Call and extensions that are not even configured in 3cx. All this is happening throughout an SBC remote office.
What will you recommend?
Thank you


this is event log "Unidentified Incoming Call. Review INVITE and adjust source identification:. INVITE sip:[email protected]:5060;transport=UDP SIP/2.0. Via: SIP/2.0/UDP 127.0.0.1:5080;branch=z9hG4bK-524287-2---585496095;rport=5080. Via: SIP/2.0/UDP xx.xxx.xx.xxx:60887;branch=z9hG4bK-524287-1---tunneltid;rport;tnlid=sbc.99e05d86. Via: SIP/2.0/UDP 185.210.157.66:58996;branch=z9hG4bK585496095. Max-Forwards: 68. Record-Route: <sip:[email protected]:5080;user=proxy;uri=sbc.99e05d86>. Record-Route: <sip:[email protected]:5060;user=proxy;tnlid=sbc.99e05d86>. Contact: <sip:[email protected]:58996>. To: <sip:[email protected]>. From: <sip:[email protected]>;tag=75698632. Call-ID: 918123095-958126283-806469888. CSeq: 1 INVITE. Allow: ACK, BYE, CANCEL, INFO, INVITE, MESSAGE, NOTIFY, OPTIONS, PRACK, REFER, REGISTER, SUBSCRIBE, UPDATE, PUBLISH. Content-Type: application/sdp. Content-Length: 208. v=0. o=2000 16264 18299 IN IP4 192.168.1.83. s=call. c=IN IP4 192.168.1.83. t=0 0. m=audio 25282 RTP/AVP 0 101. a=rtpmap:0 pcmu/8000. a=rtpmap:8 pcma/8000. a=rtpmap:101 telephone-event/8000. a=fmtp:101 0-11"

 

[bitn2]

You can limit your sip port to the network of your sip provider. Thats what we are doing with most of ouer customers.

This is the same solution for you.