Strange Calls

[lutz]

This just started happening today, anyone have any ideas?
The calls are to random extensions, they answer and no one is there.
Firewall checker is clean, I have no idea what else to check.

 

[cobaltit]

Possibly direct SIP attempts. We know the firewall checker is good, otherwise the calls wouldn't reach 3CX. What version of 3CX are you using and do you have direct SIP enabled?

 

[lutz]

Possibly direct SIP attempts. We know the firewall checker is good, otherwise the calls wouldn't reach 3CX. What version of 3CX are you using and do you have direct SIP enabled?

15.5 (upgrading tonight) direct sip is off.

 

[leejor]

Does the 3CX Activity Log show the calls coming through your providers trunk, to the extensions?

 

[lutz]

Does the 3CX Activity Log show the calls coming through your providers trunk, to the extensions?

No, it's from the phone system, nothing from my provider, i checked the calls and they do not come from them.

 

[lutz]

Upgraded to 16.0.910, still getting the calls, ran the firewall checker again, still clean, not sure what to do to resolve this.

 

[lutz]

calls have stopped for now, still not sure what was going on, I changed the password in the bridge that I have setup so it would go down, then put the password back, it came back up and now the calls have stopped. really strange.

 

[Evolute IT]

calls have stopped for now, still not sure what was going on, I changed the password in the bridge that I have setup so it would go down, then put the password back, it came back up and now the calls have stopped. really strange.

Could you see in the Activity Log of 3CX where those call came from?

 

[lutz]

Could you see in the Activity Log of 3CX where those call came from?

no, it gave no details.

 

[AWS2P]

Do you use a software or app with ability to autodial , perhaps generating always same sequence , or may be a tired deskphone becoming crazy and calling this sequence alone.

Could it be a modem call if you have ATA ?

 

[JohnS_3CX]

If this continues then stop the bridge again to see if they also stop. May be something coming the bridged PBX side

 

[leejor]

If the calls pass through the PBX, from a Bridge trunk, or otherwise, they will show in the Activity Log. If there is no log whatsoever, then it would have to be assumed they are Direct SIP calls. and much harder to track down. Perhaps with Wireshark.

 

[SteveITS]

The "from" text looks like an SQL injection attempt to me. "or 3=3" would be the "or true" statement and "--" is the SQL comment-out text.

 

[JohnS_3CX]

Good eye Steve, it seems so

 

[lutz]

The "from" text looks like an SQL injection attempt to me. "or 3=3" would be the "or true" statement and "--" is the SQL comment-out text.

I thought this as well, but couldn't find anything, so far it has not happened since the upgrade.
I'll post if anything changes.

Thank you everyone.

 

[AWS2P]

Hope for you this is done, Perhaps V16 upgrade has purged some bad settings or something broken in old PBX version.