Are these actually showing up in your CDR? If not, someone could be hitting your phones directly if you have 5060 exposed. Had an issue recently where a few users were complaining of hundreds of calls per day from odd extensions. Nothing was showing up in CDR and they were remote users with phones at home, their phones were exposed with 5060 naked on their firewall. Once I changed the port on the phones themselves, it all stopped. Never ran into this before because every firewall I have seen with phones behind it on the NAT, randomizes the listening port that’s exposed. With these user’s home routers, they were exposing the exact port that the phone was listening on. Seems pretty stupid if you ask me, what if they have more than one SIP device. In any case, I am sure there are lots of home routers that do this and by default most phones listen on 5060.
1 Like