Mystery incoming DIDs

[AndrewT]

Below is the server log of an incoming call.

07-Oct-2015 10:25:27.222 IncomingCall: C:2319 from <sip:[email protected]:5060> to <sip:[email protected]:5060>
07-Oct-2015 10:25:27.222 Added leg L:C:2319.1[No endpoint yet]
07-Oct-2015 10:25:27.221 UasSession 377133 started
07-Oct-2015 10:25:27.221 Call from "WIRELESS CALLER "<sip:[email protected]>;tag=gK047d0164 to <sip:[email protected]>;tag=dc391b2e

The call is coming from 7632421106 to 7632517550. Where the 6122542999 incoming DID is coming from is a complete mystery, but it is screwing up our inbound rules. We see this on multiple incoming DIDs from multiple sources and it seems to be getting worse and we haven't changed anything!

We are on V12.5 with no gateway.

Thanks,
Andrew

 

[lneblett]

The IP 208.93.226.8 shows to belong to Broadvox. You can do a similar lookup (who is) on the other addresses and perhaps piece together more about the issue. If you use Broadvox as a provider, they may be able to help further. It is not clear as to why it is screwing up the rules from the log or its impact. You might be able to set up your router such that it will only accept known good IPs from your provider.

You should consider masking the IP addresses using Xs going forward as those who like to hack may have just been presented with likely target attempts