Hi, Anyone had this before where calls are being made from CID's like 15, 1000 etc? We are using SIP trunks also.

Possibly a notification or trunk forward not setup correctly - I would get your vendor to take a look at it.

Sounds like a hacker trying to get in via SIP trunks. Is port 5070 open to the outside world on the SIP router?? Also delete all spare port and virtual station numbers as these guys are trying to find and opening. Have a look at the SMDR record see if you can see the calls coming in..

Its a hacker.

Use wireshark to identify the source IP and block it in the router, or better yet, get a list of IPs that the ITSP uses and blacklist all other IPs and only allow the IPs the ITSP use.

thanks for the replies guys. Definitely was a sip scanner. Closed ports on the router and no more calls

what ports you closed?

5050 to 5070 and I'm using 5080 now

sounds like SIP attack,

try tick 10-29-01 and 10-29-02

That usually solves