Call made to external number looped back to itself?

[ebrowne_sts]

I don't really know how to title this but we had an issue where Telnyx alerted us to high-cost outbound calls coming from our connection. After much searching it was narrowed down to an extension making outbound calls before hours almost every 10-30 seconds to a specific external number and the length being more about an hour for each. See below screenshots:


From Telnyx side:


Looking at the 3CX call report, at some point the caller ID and the Destination are the same with a duration of more than an hour sometimes.

What could this possibly be?

 

[TheodorosG_3CX]

The timeframe is very specific. Have you tried to regenerate the extension credentials and check if the issue happens again?

 

[ebrowne_sts]

The timeframe is very specific. Have you tried to regenerate the extension credentials and check if the issue happens again?

I did and it looks like it stopped. I did notice calls to that same number from other SIP Trunks. I will check those 3CXs and make sure the same is not happening.

 

[ebrowne_sts]

The timeframe is very specific. Have you tried to regenerate the extension credentials and check if the issue happens again?

The sim call limit affect all calls on the system, correct? Assuming that's true, how can 3CX place more outbound calls than the Sim call limit? Based on the report I ran; I counted about 59 outbound calls between 4:24am and 4:34am all with 1 hour long durations, on a 48 sim call system

 

[ebrowne_sts]

The sim call limit affect all calls on the system, correct? Assuming that's true, how can 3CX place more outbound calls than the Sim call limit? Based on the report I ran; I counted about 59 outbound calls between 4:24am and 4:34am all with 1 hour long durations, on a 48 sim call system

Disregard, on that same report, I saw where around the 48th sim call where it says limited by license. The time stamps were throwing me off before.

 

[ebrowne_sts]

In what situation and how would the From and the To be the same as below? I understand using a compromised extension, but I can't wrap my head around From and To being the same number: