We have a working FreePBX system 22.214.171.124 that has worked for a couple years now. Our telephone service is delivered by the cable company, delivering 4 analog lines into a Rhino RCB8FXX card. System works well – calls come in, calls go out, email is processed: life is great.
Then we found an 800 problem. According to the cable company, a caller started coming in on our 800 number, and then used our system to make an outbound call, some lasting for hours, and racking up phone charges.
I checked the internet access logs, and no problems there. You cannot reach our phone server from the internet, as it is protected by a firewall, and there are no port forwards for select access. I purposely designed it as such to avoid any internet problems.
– Check a time condition. In this case, it is after hours, so go to the IVR
– IVR states we are closed, please leave a message for 1 sales or 2 service
– Go to the VM collection extension (x390) and play the unavail message, and open a recording
– Assume call terminates
My log (posted below) shows this process flowing through, but has some considerations that I don’t understand:
a) CallerID number is shown to be the number the cable company claims we called
–> I expect that I should see an origin number, and a destination number
b) I do not see any dialed text going outbound…
–> Maybe this is just an inbound phone call on the 800 line, going to the VM box, and just sitting there until it disconnects / terminates. But then, why wouldn’t I have a huge vm recording like a normal voicemail?
Questions that I have for the forum:
Am I reading the call properly, that the call is coming in, using the toll-free line, and that by box is not redialing to make a new call?
Any idea where the VM recording went? I am puzzled why this evidence is not left here for us to examine. Is it possible for someone to trigger a recording, and make an outbound call?
Is the maxsecs parameter valid for this scenerio to limit the call?
Is there a way that the system could track the incoming number, and say if the same number calls 3x in a row, that it terminates the call? Note that these calls happened after hours, and there were no calls processed in-between.
Is there anything obvious that I am missing?
Because we are receiving analog from the cable company, I have no way to distinguish the 800 number from a normal toll call.