Wich Extension causes blocked IP events

[Lexima]

In the event log I see a few Blocked IP-adresses because of too many failed authentications.
Is there any way to see wich extension/user has caused this event?

 

[Saqqara]

The reason is in the description for the blacklist

for example

 

[Lexima]

I see the description - failed authentication - but which user is that? or which extension?
about half of the users are using an iPhone and almost everyone does use the Windows/MacOS app.

Also have the same entry that you posted - same IP - same Cisco only other time... - Any idea what that is.

 

[Saqqara]

These are attempts on your 3CX to hack into your system, 3CX has detected this and blocked the IP address - it is doing its job.

You can increase security by ticking 'Allow 3CX to collect any IP's that are blacklisted from this instance **' under Security Settings - Anti-Hacking

 

[Lexima]

Our 3cx server has been crashed and rebuild so every user has received a new configuration file.
I'm very sure that one or more users didn't load the new configuration and that his/her phone or app tries to login with the old credentials. - thats why I want to know the username / extention.

The users have also an deskphone for use at the office so their need to load the configuration file is not priority for them..