Knowledgebase
19Important & Helpful Info 2Sales & Quoting Tools 8Add Customers & Services 9Customer Billing 12Phone Numbers 106Hosted PBX 15SIP Trunking 15Microsoft Teams Direct Routing 6IP Fax 2Audio Conferencing 15Platform Settings 7Platform Reports 10DLC - SMS Registration Requirements 25Router & Network Help 4VoIP Troubleshooting Tools 7Release Notes
Knowledgebase: Hosted PBX > Phones & Devices
Ghost Calls
Posted by , Last modified by Marlon Sibrian on 15 June 2021 03:20 PM

Ghost Call Experience

Ghost Calls are calls that are appearing to come from unknown extensions (example: 101, 102, 1001, 1002, etc) and when answered, there is no one on the other side. Sometimes these calls can occur at random or with a consistent rate. Since these calls are IP-to-IP, they will not appear on XDRs.

The cause of Ghost Calls are Port Scans. These port scans are running to find vulnerabilities on networks that have IP based phone systems. The scans are testing IP addresses on the internet by scanning for known VoIP ports.

 

To mitigate Ghost Calls, try these two suggestions:

  1. If supported, at the end point, disable direct IP calls (Available on Yealink and Grandstream).
  2. If supported, at the end point, accept incoming from SIP proxy only or from SIP Trust server only (Available on Yealink and Grandstream).

In addition to the two suggestions, ensure the device is behind NAT. Also try changing the local SIP ports of devices (from 5060, to 5062, 5064, 5066, etc), change your IP (with your ISP), or try using a firewall. Please refer to our knowledge base article on Router Compatability and VoIP Installation Best Practices when working with firewalls.

Yealink - T28P (requires firmware V73 or V80)

Accept SIP Trust Server Only

  1. Log into the web interface and go to Account tab
  2. Select the Account 
  3. Go to Advanced from left menu options
  4. Scroll to find Accept SIP Trust Server Only and set to Enabled
  5. Click Confirm

Disable Direct IP Calls

  1. Click on Features tab
  2. Go to General Information from left menu options
  3. Scroll to find Allow IP Call and set to Disabled
  4. Click Confirm

 

Grandstream - GXP2160

Accept SIP Trust Server Only

  1. Log into the web interface and go to Accounts
  2. Go to SIP Settings
  3. Go to Security Settings
  4. Find Accept Incoming SIP from Proxy Only and set to Yes
  5. Click Save and Apply

Disable Direct IP Calls

  1. Click on Settings
  2. Go to Call Features
  3. Find Disable Direct IP Call and set to Yes
  4. Click Save and Apply

 

 

Grandstream - HT502

Accept SIP Trust Server Only

Set "Allow Incoming SIP Messages from SIP Proxy Only" to "Yes" (Found under FXS Port tab)

Disable Direct IP Calls

Set "Disable Direct IP Call" to "Yes" (Found in the Advanced Settings Tab)

 

(0 vote(s))
Helpful
Not helpful
Comments (0)
Post a new comment
 
 
Full Name:
Email:
Comments:
CAPTCHA Verification 
 
Please enter the text you see in the image into the textbox below (we use this to prevent automated submissions).