sundance-communications.com/forum Forums TDM Business Telephone Systems Samsung Telephones & Systems Fraud

Ok so i understand the below that the call is being generated from the vm..However... I dont understand how.. i have outcall set to NO in eclass and mclass,i have checked mbx alert phone number and extension alternate number, vm ports are set to COS 30

I would expect to see more info below in the activity log such as extension,menu,mode and entry.


CP 13:08.43.44 3) Using [STN Internal] station block
CP 13:08.43.44 3) Going off hook
CP 13:08.44.46 3) DCS Dial: 9009xxxxxxxx
CP 13:08.44.46 3) Monitoring call progress
CP 13:09.04.68 3) Answer: 0.00, High: 0.00, Low: 0.00 - 0.00
CP 13:09.04.68 3) Call progress result: Answer - loop current drop
CP 13:09.35.54 4) Using [STN Internal] station block
CP 13:09.35.54 4) Going off hook
CP 13:09.36.56 4) DCS Dial: 9002xxxxxxxxx
CP 13:09.36.56 4) Monitoring call progress
CP 13:09.52.69 4) Answer: 0.00, High: 0.00, Low: 0.00 - 0.00
CP 13:09.52.69 4) Call progress result: Answer - loop current drop
CP 13:10.11.76 3) First party disconnect detected

The dialling strings in the OFF Premise station block table are only set to 9? , 10? 11?

Digits used are over 14 in length ???

Go back further in the log file, there has to be a corresponding inbound on those ports. Email it to me if you would like. Also you can turn on the port monitor to increase the amount of info you see but i decreases the number of days that will be stored.
Also they have bypassed Off Premise by inserting a 9 into the number and the only way i know how to do that is in the alternate number.

Brian

I agree there has to be more info, but there isn't that i can see, have viewed the complete log. Thats what has confused me. That is the start of the activity log file.

I'll send over the log file all the same.

That's using an internal station block.

Is the outcall set to no for all 3 options on eclass and mclass?

Looks like they have changed the dial number on a mailbox.

There is a way to place a direct call from a mailbox/extension, perhaps that's what they are doing?

All outgoing call notifications were set to no in eclass and mclass, have checked all mailbox and extensions and cannot see the number within any of them.

I agree with all of the above, just cannot find the fraudlent number anywhere within the voicemail.

toll restrict the vm ports

If you don't have any legitimate notifications, set the vm ports for in only. Zero outbound at that point.

All vm ports set to COS 30

What do you have set (if anything) in the "excepted area codes"

if this is a 4.5x or higher system and you have smdr turned on it will buffer so you may get some more clues by looking at the smdr