Ghost Calls

Ghost Calls

Ghost Call Experience

Ghost Calls are calls that are appearing to come from unknown extensions (example: 101, 102, 1001, 1002, etc) and when answered, there is no one on the other side. Sometimes these calls can occur at random or with a consistent rate. Since these calls are IP-to-IP, they will not appear on XDRs.

The cause of Ghost Calls are Port Scans. These port scans are running to find vulnerabilities on networks that have IP based phone systems. The scans are testing IP addresses on the internet by scanning for known VoIP ports.

 

To mitigate Ghost Calls, try these two suggestions:

  1. If supported, at the end point, disable direct IP calls (Available on Yealink and Grandstream).
  2. If supported, at the end point, accept incoming from SIP proxy only or from SIP Trust server only (Available on Yealink and Grandstream).

In addition to the two suggestions, ensure the device is behind NAT. Also try changing the local SIP ports of devices (from 5060, to 5062, 5064, 5066, etc), change your IP (with your ISP), or try using a firewall. Please refer to our knowledge base article on Router Compatability and VoIP Installation Best Practices when working with firewalls.

Yealink - T28P (requires firmware V73 or V80)

Accept SIP Trust Server Only

  1. Log into the web interface and go to Account tab
  2. Select the Account 
  3. Go to Advanced from left menu options
  4. Scroll to find Accept SIP Trust Server Only and set to Enabled
  5. Click Confirm

Disable Direct IP Calls

  1. Click on Features tab
  2. Go to General Information from left menu options
  3. Scroll to find Allow IP Call and set to Disabled
  4. Click Confirm

 

Grandstream - GXP2160

Accept SIP Trust Server Only

  1. Log into the web interface and go to Accounts
  2. Go to SIP Settings
  3. Go to Security Settings
  4. Find Accept Incoming SIP from Proxy Only and set to Yes
  5. Click Save and Apply

Disable Direct IP Calls

  1. Click on Settings
  2. Go to Call Features
  3. Find Disable Direct IP Call and set to Yes
  4. Click Save and Apply

 

 

Grandstream - HT502

Accept SIP Trust Server Only

Set "Allow Incoming SIP Messages from SIP Proxy Only" to "Yes" (Found under FXS Port tab)

Disable Direct IP Calls

Set "Disable Direct IP Call" to "Yes" (Found in the Advanced Settings Tab)

 

    • Related Articles

    • How to Park and Retrieve Calls

      Call Parking enables you to "hold" a call in a "parking lot" (aka parking orbit) so that it can be retrieved by the same or another extension when they are available. It is similar to the hold functionality offered by legacy key systems but still ...

    • Call Center Features

      Hosted Call Center customers have access to all hosted PBX features and a specific set of Supervisor and Agent centric reporting and routing tools. Queue Routing Standard IVR with unlimited levels and options for multiple entry points Multi-language ...

    • Call Parking in SNAPmobile Web

      This topic explains how to use the new call park functionality in SNAPmobile web. Now you will be able to use call park in your SNAPmobile web browser based webphone. This functionality at your fingertips means less switching between web and manager ...

    • How to enable Call Recording

      Call Recording is an add-on feature to any Hosted PBX or Hosted Call Center solution. Please refer to your MSA for more information on pricing and packaging. However, call recording is currently being offered as a service. There are 2 methods for ...

    • Call Parking Ringback

      Overview By default, parking lots created in the 710 - 719 range will have ringback enabled. This means that calls parked in this range will "ring back" to the original extension that parked the call after the default 5 minute timer has expired. More ...