B179 Getting calls from 1004

[robakabobbo]

Weird situation here. I have had this B179 built and just chilling here in my phone room for 3 months. Never had a problem. The location that is it's new home, was finally setup, and I placed the B179 in there. After an hour of it sitting there, I received a call from the users saying it was getting calls from 1004. Anyone seen anything like this before? When you hit the calls to answer it, dead air, nothing. Thoughts on the matter?

 

[robakabobbo]

Would like to add that their is no extension 1004, and we have SIP trunks from our Nortel cs1k to this. Server edition with IPOCC. This is not tied to the IPOCC.

 

[mojoputter]

So have you used System Status to see if the call is coming in from an external or external number?

The end is near!

 

[TheSmash]

I'd put money on you having port 5060 open and this is pointing to the B179.

ACSS (SME)

 

[amriddle01]

Yep, it's people trying to register handsets to it from the web I'd wager.

As we're a SIP provider we get reports from customers all the time saying they're getting phantom calls from similar numbers all day, they've actually forwarded 5060 to the phone/system and haven't locked it down correctly/at all and it's the hack attempts causing the calls

 

[robakabobbo]

Port 5060 open on the IPO? I did see that is checked on my system. How would I lock this down? or any suggestions would be appreciated.

 

[amriddle01]

It being open on the system is fine, it needs to be. It's if you have forwarded 5060 to the system/phone from the internet that it becomes an issue

 

[robakabobbo]

So I plugged it in this morning, after an hour, it started up again. It did not show up in the active calls. Its kind of neat.

 

[amriddle01]

Sure sounds like you have it forwarded through the router then, if the system was causing the call it would show up 100%

 

[robakabobbo]

I'll be honest then, I have no idea what you mean by forwarded through the router. I've been trying to change the password on the phone so It cannot be messed with and it keeps reverting.

 

[AACon]

It means someone on the IT site decided to open UDP port 5060 through the firewall and directed it towards your B179.
It also means johnny hacker jerk is port scanning with sip vicious (or similar) your WAN/Internet IP to find open SIP ports and found one, and is now trying to register through it in order to hi-jack your system and make international calls to czechitslavistamania or wherever.
Tell the IT guy to close down port 5060 if it's not needed to be open.
Often it is (for SIP trunking, or remote clients), but it clearly sounds like it was done incorrectly.

-Austin
I used to be an ACE. Now I'm just an Arse.

 

[intrigrant]

To get rid of the calls then erase the default gateway route in IP Office and set the default gateway in the SIP phone with the IP Office IP Address.