Ghost calls

What are ghost calls?

Customers often receive “ghost” calls, where there’s no one on the other side, and no records show in the PBX call history.

This is typically due to SPIT (Spam over Internet Telephony) in the VoIP realm. Malicious individuals use a SIP dialler to search for IP addresses that respond to a SIP INVITE. Most SIP phones, when on default settings, respond to any INVITE, allowing hackers to know of your device, and cause it to ring.

How do I know if I’m getting ghost calls?

Review the PBX call history. If there’s no log, it’s likely calls are from a scanner.

How can I prevent ghost calls?

1. Disable IP calls: Certain devices allow you to disable IP calls altogether. Check your device’s manual if yours has this capability.

2. Only permit calls from our SIP proxy: Again, this is device specific. In device settings, if there is something similar to “Accept Incoming from SIP Proxy Only” make sure it is checked. Examples below:

Grandstream: https://www.yay.com/faq/voip-phones/ghost-calls-grandstreams/

Yealink: https://www.yay.com/faq/voip-phones/yealink-t48g-ghost-calls/

3. Change device’s default SIP port: Instead of 5060, use another port. (Note: there is still a chance that bad actors could scan every port)

4. Block SIP packets from unknown senders: From your router or firewall, block inbound SIP packages except those that originate from our SIP server/proxy.