We have a log of numbers that were either called or transferred that I need to find out more information about. The line items for one of them is as follows:

04/16 10:26 06:23:48 6012 91XXXXXXXXXX AT023T T001
04/16 10:25 06:24:49 T001 001 12505 5008 6012X T023 12505

It's off of a Mitel 3300 IP system. We do not have any call accounting software. Thanks.

What is it your trying to figure out?

I was trying to make sense of the log. I did find out that 6012 is an extension, but it's part of a voicemail retreive group. The 91XXX.. is the phone number that was dialed. But I'm not sure what AT023T is after the number. Seems like T023 is a trunk number, but what do the other letters represent?

After more work, it looks like a call came in at 10:25 and got transferred to ext. 6012, but it's not a actually voice extension. Then at 10:26 a call went out to 91xxxx... So I'm trying to find out if someone is calling from the outside to use our line to call out. Thanks.

In the second example, it appears that an incoming call was transferred by extension 5008, temporarily connecting trunk 001 with trunk 023.

It looks like someone called in on T023, was answered by the voicemail port ext. 5008, logged into the voicemail retrieve group 6012, and transferred out on T001 to the 91XXX number.

Does your voicemail system have a "press 8 to return this call" feature? If so, the caller likely answered a voicemail message by allowing the voicemail to call back a caller who had left a message.

Alternately, your voicemail may have been hacked. See if there is a mailbox which has "9,," as the "transfer to -->" number, or even the entire 9,1xxxx number.

Note: You can turn on "inbound SMDR" -- should be option 806 in COS for SX200, not sure on 3300 -- and that would show you another line, just under this one, with information about who had called in and how.

It doesn't seem like I have those options. Tried replicating it but nothing.

The part that confuses me is that in line 2 which looks like the first call, comes in on trunk T001 gets picked up on VM line 6012 and then gets transferred to a trunk T023, where it then calls the 91XXX number on trunk T001 again.

I just want to replicate this so I can block it.

I think that's backwards. Normally the Trunk number is on the right side, so I think this indicates T023 in, transfers to T001, then calls 91xxx...

You can block CO line to CO line connection, but then you can never xfer offsite.

I strongly recommend that you check your voicemail -- go box by box if you have to -- and look for a mailbox that transfers to 9,, or that transfers offsite.

And look for NEW, unknown mailboxes. AND CHANGE YOUR VM ADMINISTRATION PASSWORD!!!!!

The call came in at 10:25 on trunk 1 which was directed to ext. 12505 and then 5008 and was answered by ext 6012. Then ext 6012 transfered to the 91XXXXXXX and it went out on trunk 23. The A means Answer Supervision and the T following means it was a supervised transfer. Somehow you are allowing calls to be transfered from voicemail to outside numbers. Not good.

I stand corrected. But clean that voicemail!

Are you allowing transfer to cell phones through the voicemail? The greeting says if you want to reach me on my cell phone press 2. Haven't looked at the call records on a 3300 to know if the records for a transfer to cell phone looks like your example.

jonmyk,

You're right. I found out from Mitel that someone's voicemail is setup to do personal calls when you call the VM system. I set it up myself and replicated the log. There is a feature on our Mitel that can disable this, which I will be doing because no one here should have that setup.

Thanks everyone for your information and feedback.