Unexisting Extension Making Random Calls to different users

[vincent Kavila]

Hello,

I have noticed an Unexisting Extension Making Random Calls to Different Users, how do I trace the problem and sort it out?
How do I trace the extension 100 and block it?

 

[xcobean]

Hello,

So when you check in your instance there's totally no extension with that extension?

there are a few ways we can take to check on this:
1. You can install sngrep package which helps in showing sip calls in an intitive way and show the ips origicatign the calls.
2. You can block port 5060 (you may ask your sip provider to map the calls to another port then you test if the calls still show (or whitelist the hosts that connect to you via port 5060)
3. Check if there are no bridges or other secondary sip trunks you can configured that may be calling through.

 

[vincent Kavila]

Hello,

So when you check in your instance there's totally no extension with that extension?

there are a few ways we can take to check on this:
1. You can install sngrep package which helps in showing sip calls in an intitive way and show the ips origicatign the calls.
2. You can block port 5060 (you may ask your sip provider to map the calls to another port then you test if the calls still show (or whitelist the hosts that connect to you via port 5060)
3. Check if there are no bridges or other secondary sip trunks you can configured that may be calling through.

Thank you, let me try out that.

 

[SteveITS]

Just to double check, for a little while now x100 is the default system owner extension 3CX creates during installation, that's not it?

A while back 3CX had a blog post series on securing a server that may be of help.
https://www.3cx.com/blog/unified-communications/dont-be-that-guy-vol-2/
https://www.3cx.com/blog/unified-communications/dont-be-that-guy-vol-3/
from -> https://www.3cx.com/blog/author/pjourdan/

 

[hald9000]

I ran into a similar problem when a PC on the network was hacked. After fixing the PC I went and changed all of the Phone's provisioning passwords and VoiceMail PINS as with the hack the hacker now likely knows you obfuscated Provisioning URL and can also know your MACs as well. The Provisioning URL does not require a password BTW you just have to know the obfuscated URL path and be familiar with 3CX. With knowing those things, I can get a lot of details about the phone system.