Sounds like a hacker trying to get in via SIP trunks. Is port 5070 open to the outside world on the SIP router?? Also delete all spare port and virtual station numbers as these guys are trying to find and opening. Have a look at the SMDR record see if you can see the calls coming in..


Regards,

Paul W
Now back to a 0 day week. Love these 7 day weekends.