Ghost Calls

[sevenvoip]

In the past week, I have a client that will have 6-8 calls at one time to the same number. I'm assuming this is what's considered a "Ghost Call", but I'm not sure. It's always to the same number, until I block that particular number. Then the next day a new number will do it. Any idea how to fix this or what could be the problem? See below...

 

[leejor]

If the calls are coming in from your provider, then you'd have to either block the number, or seek assistance from your provider to see if they care able to block, or trace. If the number keeps changing, then it is going to be that much more difficult. I would suspect that someone is targeting you.

I would not consider this a "ghost call". A ghost call is usually something that happens on occasion, has no originating number, and usually comes in as a Direct SIP call. This seem rather deliberate.

It could also be some automated service run amok. Have you looked up the originating number?

 

[sevenvoip]

Yes. I've looked up both originating numbers that have caused this issue. When I call it, it seems to be some spanish radio station. The crazy part is, some times the number is both originating and terminating number. I need to try and figure this out ASAP as they are running up our SIP trunk bill. I've asked our SIP trunk provider to look into it, but they are not seeing any issues on their end.

 

[nub]

Activity log should have everything we need to know.

I would check the config for ext 204 and see what the mobile number is and under options check the box for "Disallow use of extension outside the LAN (Remote extensions using Direct SIP or STUN will be blocked)"

if the calls stop change the password for provisioned phone.

lot of other things that can be checked but this is the start.

 

[sevenvoip]

I can't check that box as this is a Grandstream WP820. I am not able to auto-provision it. This would be considered direct SIP, no?

 

[nub]

If you goto phones > under ip, is the ip address for ext 204 outside the lan?

 

[sevenvoip]

I made this change on Monday afternoon and haven't seen any "ghost calls" (as I call it) since. Thanks!

 

[noord]

That means someone (a hacker or script kiddie) has guessed or stolen the password of the extension.
Please change the password asap just to be sure. And check all other extensions as well, you don't know how they obtained the password (by guessing it because it was Welcom01 or they have somehow found a password list somewhere?)

 

[sevenvoip]

Yes, I can confirm a hacker got in and was using our extensions as I found a strange IP (Kazakhstan) in the logs associated with authenticating with that extension. I've since changed the auth ID and the password.