Extension Ringing from Non-Existent Extension

[Houston_Tx]

We have started experiencing phones ringing with the caller ID appearing to be from an internal extension that does not exist. The calls do not exist in the call log. Call history on the extension shows calls from random numbers such as "100", "1001", "301". This seems to be happening on only 1 extension, which is a Yealink W-52P wireless handset.

The extensions are remote STUN extensions on a hosted version of 3CX. So far, this has only happened on the 1 handset, and has not happened on any of the local network wired extensions or the other W-52P handset. This does not happen all the time, but once the handset rings once, the calls will continue every 5 minutes or so.

 

[eddv123]

Hi Houston_Tx,

It sounds like these are ghost calls and are normally the result of an attempted SIP hack.

This can be common with remote phones using STUN as they are a lot less secure than if you were to use the 3CX SBC or VPN.

I am not sure what phones you are using but to prevent these (other than swapping your STUN phones to SBC) it can be done in the interface of the phone (examples below for Yealinks):

http://support.yealink.com/faq/faqInfo?id=559
http://support.yealink.com/faq/faqInfo?id=181

Or I would on the Extensions in 3CX regenerate your SIP authentication credentials (the can be done very easily now with a single click) on the "extensions" page.

You might also wish to take precautions on your trunking platform and restrict calls and costs outside of office hours to a minimum.

 

[complex1]

Hi,

If you are running f/w v80 or later on the W52P then the template is incorrect.
Please add next parameter to the template to correct this issue.

#Enable or disable the phone to only accept the message from the server; 0-Disabled (default), 1-Enabled;
sip.trust_ctrl = 1

Also make sure the password of the user account is set and leave it not default.
This too is not added to the template (security issue)

Hope this will help.

 

[YiannisH_3CX]

Hello @Houston_Tx

Additionally to what was mentioned another way to deal with the issue to assign an unusually high SIP port to the phone through the management console that is not included in auto scanning tools.
You will need to re-provision the device after the port is changed.