Calls from 1001

[dynamic]

I keep getting calls from a 1001 number constantly. When I pickup there is nothing. There is no server activity for the calls coming to my extension. There is no 1001 setup on my system. I have restarted everything to no avail. I have even put 1001 into block list on 3cx. Any ideas?

 

[dynamic]

If I look at the history on the phone I see this:


Received List
Date Time Local Identity Name Number
1 Thu Dec 04 23:33 SIP [email protected] 1001 [email protected]
2 Thu Dec 04 19:28 SIP [email protected] 1001 [email protected]
3 Thu Dec 04 19:24 SIP [email protected] 1001 [email protected]

 

[lneblett]

It is someone using a program like SIPVicious to access your system and/or phones externally. Depending upon the phone model, there are usually some settings that can be modified to minimize or eliminate the phone from reacting to it. You may want to disallow direct sip calling, allow only trusted sources, or similar such settings depending upon your model of phone. You should also turn-off sip calling in 3CX. See the link following-
http://www.3cx.com/blog/voip-howto/direct-sip/

 

[dynamic]

Now it's coming from 101. What's going on? Has my system been hacked?

 

[leejor]

Look in the 3CX server log. That will tell you where the call originates.

 

[tsukraw]

What kind of connection do you have for your voice service? By chance a SBC?

Just throwing a idea out there from a issue i saw.
Had a customer who had a SBC that was configured to accept SIP connections from there there SIP carrier and any other SIP connection.

There are always SIP hacks being attepted to systems. IPs constantly being blocked. They did not have there SBC configured correctly so each time they received SIP traffic to a DID of (*) it would make there phones ring. Drope them up the wall until i locked there SBC down to just there SIP Trunk carrier and the specific DIDs the carrier was providing instead of a wild card (*).


Just a idea. Not sure if you have anything configured with that but if so you might want to lock down your DIDs to the DIDs themselves instead of a wildcard.

 

[complex1]

Now it's coming from 101. What's going on? Has my system been hacked?

Did you read the reply of “lneblett” and what is the outcome?
What type/model phone are you using?