A lot of unknown calls coming through loopback, cannot get rid of them

[SwaggerRO19]

Hey guys,

I have a 3CX PBX which it's hosted into cloud, with a direct IPv4 address assigned to the Virtual Machine.

This VM also has a lo interface assigned. I'm seeing a lot of calls (about 7-800 per hour) which are unknown and seem to be kind of fake calls, but I cannot get rid of them...

I tried enabling all the firewall and only allowing port SSH 22 TCP so I can still have access to the server, but they were still coming in. I've disabled the LO interface, still coming.

Does somebody else have this issue? If yes, could I please be pointed into a fix for this issue?



Thanks,
Swagger

 

[leejor]

Not familiar with that particular log, so I may be a bit confused.

Why is the called num so different on each call? I would expect that to be your number, or are you (your PBX) placing the calls?

I see a lot of repeat IPs, are they yours, or your providers? Are these direct SIP calls, or going through a provider?

Not clear on the purpose of flooding (targeting) you, with several hundred incoming calls

If the calls do originate from the same IP, or several, you could try blacklisting them in 3CX, or a firewall. If they come through a provider, then perhaps they could be enlisted to block them.

 

[HRMNY]

Hey guys,

I have a 3CX PBX which it's hosted into cloud, with a direct IPv4 address assigned to the Virtual Machine.

This VM also has a lo interface assigned. I'm seeing a lot of calls (about 7-800 per hour) which are unknown and seem to be kind of fake calls, but I cannot get rid of them...

I tried enabling all the firewall and only allowing port SSH 22 TCP so I can still have access to the server, but they were still coming in. I've disabled the LO interface, still coming.

Does somebody else have this issue? If yes, could I please be pointed into a fix for this issue?



Thanks,
Swagger

Are you using an SBC or STUN? If you are using an SBC you should configure your network firewall to only allow SIP traffic from your SIP provider.

 

[SweetAction]

Hey guys,

I have a 3CX PBX which it's hosted into cloud, with a direct IPv4 address assigned to the Virtual Machine.

This VM also has a lo interface assigned. I'm seeing a lot of calls (about 7-800 per hour) which are unknown and seem to be kind of fake calls, but I cannot get rid of them...

I tried enabling all the firewall and only allowing port SSH 22 TCP so I can still have access to the server, but they were still coming in. I've disabled the LO interface, still coming.

Does somebody else have this issue? If yes, could I please be pointed into a fix for this issue?



Thanks,
Swagger

The log looks like it isn't show you calls but rather showing you registration attempts, all pictured are failing (except 1) due to bad creds (last response column).

I bet if you played the pcap through wireshark you would see no actual call stream either.

Not familiar with that particular log, so I may be a bit confused.
<snip>

It looks like 3rd party https://www.voipmonitor.org/

 

[SwaggerRO19]

Yup, I'm using 2 remote SBC's. One it's in OCI, one it's locally to a customer's home network, because of the 3CX cutting of Polycom supported devices.

But the issue it's that I can't locate the source of these fake calls. I'm telling them fake calls because I do not recognize them at all.

I'm not initiating them and I should not receive them...

 

[SwaggerRO19]

The log it's actually from VoIPMonitor, forgot to mention, sorry.

Yes, I ran a PCAP locally to the 3CX PBX, I'm not seeing any of these calls...

Any ideea how can I trace them down and cut them?

 

[SwaggerRO19]

I've disconnected the SBC that's in the OCI, no success, calls are still coming through as they were when the SBC was connected.

The OCI SBC it's just a test SBC, so I do not need it. The other SBC it's behind LAN & NAT, and there's no way that it's coming all the traffic from that one, since I checked the infrastructure of the customer and the SBC VM has only access to the specific 3CX SBC ports.

 

[SweetAction]

I'm pretty sure it just registration attempts. Lock down port 5060 in front of the PBX to only IPs of SIP Trunks and Direct Phones (STUN). Let us know if these attempts disappear.