Knowledgebase: Hosted PBX > Phones & Devices
Ghost Calls
Posted by Jimmy Fuentes, Last modified by Marlon Sibrian on 15 June 2021 03:20 PM

Ghost Call Experience

Ghost Calls are calls that are appearing to come from unknown extensions (example: 101, 102, 1001, 1002, etc) and when answered, there is no one on the other side. Sometimes these calls can occur at random or with a consistent rate. Since these calls are IP-to-IP, they will not appear on XDRs.

The cause of Ghost Calls are Port Scans. These port scans are running to find vulnerabilities on networks that have IP based phone systems. The scans are testing IP addresses on the internet by scanning for known VoIP ports.


To mitigate Ghost Calls, try these two suggestions:

  1. If supported, at the end point, disable direct IP calls (Available on Yealink and Grandstream).
  2. If supported, at the end point, accept incoming from SIP proxy only or from SIP Trust server only (Available on Yealink and Grandstream).

In addition to the two suggestions, ensure the device is behind NAT. Also try changing the local SIP ports of devices (from 5060, to 5062, 5064, 5066, etc), change your IP (with your ISP), or try using a firewall. Please refer to our knowledge base article on Router Compatability and VoIP Installation Best Practices when working with firewalls.

Yealink - T28P (requires firmware V73 or V80)

Accept SIP Trust Server Only

  1. Log into the web interface and go to Account tab
  2. Select the Account 
  3. Go to Advanced from left menu options
  4. Scroll to find Accept SIP Trust Server Only and set to Enabled
  5. Click Confirm

Disable Direct IP Calls

  1. Click on Features tab
  2. Go to General Information from left menu options
  3. Scroll to find Allow IP Call and set to Disabled
  4. Click Confirm


Grandstream - GXP2160

Accept SIP Trust Server Only

  1. Log into the web interface and go to Accounts
  2. Go to SIP Settings
  3. Go to Security Settings
  4. Find Accept Incoming SIP from Proxy Only and set to Yes
  5. Click Save and Apply

Disable Direct IP Calls

  1. Click on Settings
  2. Go to Call Features
  3. Find Disable Direct IP Call and set to Yes
  4. Click Save and Apply



Grandstream - HT502

Accept SIP Trust Server Only

Set "Allow Incoming SIP Messages from SIP Proxy Only" to "Yes" (Found under FXS Port tab)

Disable Direct IP Calls

Set "Disable Direct IP Call" to "Yes" (Found in the Advanced Settings Tab)


(0 vote(s))
Not helpful

Comments (0)
Post a new comment
Full Name:
CAPTCHA Verification 
Please enter the text you see in the image into the textbox below (we use this to prevent automated submissions).