Ghost calls from numbers like 1001,4001,5001,6001 etc, coming via SIP trunk to 3CX

[DjordjeV]

Hello , since yesterday we have been dealing with spam ghost calls that are coming via SIP trunk (provider) every 2 mins . We are not getting SIP service via internet , we are getting it directly from our SIP provider , so internet and SIP traffic are separated. We also do not have any STUN or remote extensions and our SIP port is only open to our provider (not to the Internet). Calls are from numbers like 1001, 2001, 3001 ,4001 and on and on... Any idea what it is the problem and how to solve this?

 

[cobaltit]

Are sure those are coming in via the SIP trunk? You've confirmed via the logs? Because if they are, that's a question for your SIP provider.

 

[DjordjeV]

I have seen in the Dashbord> Active calls , there call is displayed like it is coming from SIP trunk

 

[leejor]

Confirm using the 3CX Activity Log. That will show exactly where the call originates.

 

[DjordjeV]

Confirm using the 3CX Activity Log. That will show exactly where the call originates.

Here is one of the calls from activity log

 

[DjordjeV]

Are sure those are coming in via the SIP trunk? You've confirmed via the logs? Because if they are, that's a question for your SIP provider.

Please find on of the call flows from spam numbers

 

[leejor]

The only "number" I see, is what I suspect, is your 3CX trunk number, 10000. I see some IPs but you will have to identify if they belong to your provider, or, if someone is attempting a direct SIP call and not sending an originating number. If the originating IP is not your providers, you can blacklist it.

 

[DjordjeV]

The only "number" I see, is what I suspect, is your 3CX trunk number, 10000. I see some IPs but you will have to identify if they belong to your provider, or, if someone is attempting a direct SIP call and not sending an originating number. If the originating IP is not your providers, you can blacklist it.

62.4.382.46 that is only IP there from our Provider,

 

[leejor]

I see a call from IP 62.4.36.246, sending with a "phone number" of elias. If the calls are all originating from this IP, and should not be, then blacklist it. I would also give this information to your provider, as they seem to be coming in over trunk group 10000.