Weird connection attempt in server log

[daktur]

Hi Everyone,

I found many attemps of connection from different Extensions that doesn´t exist:
16-nov-2015 13:10:05.278 [CM102001]: Authentication failed for AuthFail Recv Req REGISTER from 212.83.146.50:5088 tid=251891c5cab756455648ae3b [email protected]:
REGISTER sip:74.208.125.179:5060 SIP/2.0
Via: SIP/2.0/UDP 212.83.146.50:5088;branch=z9hG4bK251891c5cab756455648ae3b;rport=5088
Max-Forwards: 70
Contact: "6146"<sip:[email protected]:5088>
To: "6146"<sip:[email protected]:5060>
From: "6146"<sip:[email protected]:5060>;tag=251891c620fc
Call-ID: [email protected]
CSeq: 2 REGISTER
Expires: 1800
Proxy-Authorization: Digest username="6146",realm="3CXPhoneSystem",nonce="414d535c0c5a82cd02:3cc31366fe275097a578873e273131ff",uri="sip:74.208.125.179",response="8ffbb3440fce36a0aabfe5c9f536c1a7",algorithm=MD5
User-Agent: VaxSIPUserAgent/3.1
Content-Length: 0

; Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings
16-nov-2015 13:09:47.231 [CM102001]: Authentication failed for AuthFail Recv Req REGISTER from 212.83.146.50:5086 tid=230571c5844556075648ae28 [email protected]:
REGISTER sip:74.208.125.179:5060 SIP/2.0
Via: SIP/2.0/UDP 212.83.146.50:5086;branch=z9hG4bK230571c5844556075648ae28;rport=5086
Max-Forwards: 70
Contact: "2850"<sip:[email protected]:5086>
To: "2850"<sip:[email protected]:5060>
From: "2850"<sip:[email protected]:5060>;tag=230571c5da4c
Call-ID: [email protected]
CSeq: 2 REGISTER
Expires: 1800
Proxy-Authorization: Digest username="2850",realm="3CXPhoneSystem",nonce="414d535c0c5a82ba68:f245ff72e451e9a78a986fe128664e2e",uri="sip:74.208.125.179",response="84c700f97b7ae6376cae890ae872e52b",algorithm=MD5
User-Agent: VaxSIPUserAgent/3.1
Content-Length: 0

Is that correct? Should I ban this IP in the Anti hacker option?

 

[lneblett]

You will find that as time goes by there will be many attempts to hack into the system. You need to insure that all passwords are strong and that you have the parameters set up for the security to your liking. Yes, you can also blacklist the IP manually within 3CX or perhaps even in your router.

 

[Twobrothers]

I am faced with this same problem.

 

[leejor]

A long time back, I set the blacklist time-out very high, something in the order of 25,000 seconds. I also made sure that I got an email every time there was a blocked registration attempt. If there are repeated attempts from certain IPs, or IP ranges, I blacklist them permanently. Theses sorts of things still occur but over time there has been a drastic reduction.