It isn't always defaults: Scans for 3CX usernames, (Mon, Nov 10th)

Observations from Cowrie honeypots show scans using 3CX-related usernames (notably "FTP_3cx") and a small set of attempted passwords, suggesting an active scanning campaign targeting FTP accounts used for 3CX PBX backups; the report lists observed usernames and password attempts and notes the risk that FTP-stored backup credentials could enable compromise of 3CX installations.