We have a failover server incase the main server fails for whatever reason. It hasn’t been used in more than 2 weeks, maybe more, and only 2 extensions are registered to it (testing extensions). So the call logs should be pretty empty but we noticed a bunch of international calls originating from it.
FreePBX: 13.0.192.16
Asterisk: 13.17.1
The international calls are coming from an assortment of extensions all of which have not been registered in 2 weeks, no SIP registrations. The only thing that looks out of place before most of these calls is a series of non-critical invite transactions right before the call or a little before it:
WARNING[19213] chan_sip.c: Timeout on _k3q1o4kDn1xb3Fs9oNHA96d… on non-critical invite transaction.
WARNING[19213] chan_sip.c: Timeout on _qmDB7cffMzCKf22LICyLZgH… on non-critical invite transaction.
WARNING[19213] chan_sip.c: Timeout on _mqy5vdVGljE90qaD1cohNsf… on non-critical invite transaction.
pbx.c: Executing [18676060566@from-internal:1] Macro(“SIP/304-000003fc”…
Some of the timeouts have an IP that says they are coming from Canada and other countries we are not in.
They seem to attempt a series of calls all at once then silence for a while then another series of calls. Has anyone had this or know if this is a current existing bug/exploit? I’m not sure if its the RTP bleed bug because it is idle except for when they call international. Doubt it is as I just installed the RTP bleed patch and I just seen another international call attempt.