{"id":1602,"date":"2015-06-24T12:38:19","date_gmt":"2015-06-24T12:38:19","guid":{"rendered":"http:\/\/www.skyswitch.com\/?p=1602"},"modified":"2022-02-18T06:05:59","modified_gmt":"2022-02-18T06:05:59","slug":"admin-calling-sip-phone","status":"publish","type":"post","link":"https:\/\/skyswitch.com\/blog\/admin-calling-sip-phone\/","title":{"rendered":"Why Does &#8220;admin&#8221; Keep Calling My SIP Phone?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">&#8220;Why does Admin keep calling my customer&#8217;s &nbsp;SIP phone? &nbsp;And when they answer&nbsp;nobody is there.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is a question that we receive frequently from new&nbsp;hosted PBX resellers. &nbsp;Usually followed by the observation that there are no call logs available on the switch to evidence the call.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The answer is usually that the customer has become&nbsp;a victim of SPIT (yes, SPIT &nbsp;a.k.a Spam over Internet Telephony). &nbsp;In the VoIP world, SPIT is pretty common. Nefarious types looking to commit toll fraud will probe random IP addresses with a SIP dialer looking for a reply to a SIP INVITE. &nbsp;When they find one, they will try to break into the web UI of the phone to setup call forwarding to expensive destinations. &nbsp;When configured with default settings,&nbsp;most SIP phones&nbsp;will send a response&nbsp;to any INVITE they receive. &nbsp;This has the unfortunate effect of &nbsp;alerting the hackers to the presence of a SIP end-point&nbsp;and , annoyingly for the user, &nbsp;ringing the phone.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Unfortunately, incidences of this behavior have become more common since the release of the SIP scanning tool called <a href=\"http:\/\/blog.sipvicious.org\/\" target=\"_blank\" rel=\"noopener\">SIP Vicious<\/a>. &nbsp; The &#8220;admin&#8221; shown on the receiver&#8217;s Caller ID reflects the root username of&nbsp;the server&#8217;s administrator when the program was installed. &nbsp;Other common Caller ID values&nbsp;are &#8220;friendly-scanner&#8221;, &#8220;1000&#8221; or no name at all.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As discussed in this <a href=\"http:\/\/serverfault.com\/questions\/549134\/how-can-i-stop-sipvicious-friendly-scanner-from-flooding-my-sip-server\" target=\"_blank\" rel=\"noopener\">serverfault post<\/a>, there are several approaches that can be used to&nbsp;to thwart these efforts. &nbsp;Many require technical skills to be able to do things like&nbsp;fine-tune&nbsp;firewall rules or send the malicious probe an invalid SIP response. &nbsp;A much easier&nbsp;way to&nbsp;combat this nuisance&nbsp;is to configure the SIP phone &nbsp;to only accept inbound calls&nbsp;from the server that the phone is registered to (although this option is not available for all manufacturers).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Of course, at SkySwitch we configure&nbsp;this option for SkySwitch hosted PBX resellers whenever possible. &nbsp;As with all device options, it can be enabled for a single customer, or an entire office, with a single override in&nbsp;the fully-automated SkySwitch device provisioning server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Remember: \u00a0Your success as a <a href=\"https:\/\/skyswitch.com\/\">hosted PBX<\/a>\u00a0<a href=\"https:\/\/skyswitch.com\/company\/\">reseller<\/a> depends on your ability to customize the look and operation of the phones that you deploy. \u00a0SkySwitch makes this easy to do. The SkySwitch device provisioning server enables <a href=\"https:\/\/skyswitch.com\/\">remote provisioning and management of all the major SIP phone<\/a> and ATA devices, including Polycom, Yealink and Cisco among others. \u00a0 To learn more, <a href=\"https:\/\/skyswitch.com\/\">contact a SkySwitch white label VoIP specialist today<\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;Why does Admin keep calling my customer&#8217;s &nbsp;SIP phone? &nbsp;And when they answer&nbsp;nobody is there.&#8221; This is a question that we receive frequently from new&nbsp;hosted PBX resellers. &nbsp;Usually followed by the observation that there are no call logs available on the switch to evidence the call. The answer is usually that the customer has become&nbsp;a&hellip;<\/p>\n","protected":false},"author":7,"featured_media":10501,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[7],"tags":[49,112,113,114,115,116,117],"class_list":["post-1602","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-automated-provisioning","tag-sip-probe","tag-sip-scanner","tag-sip-vicious","tag-spit","tag-toll-fraud","tag-voip-fraud"],"acf":[],"_links":{"self":[{"href":"https:\/\/skyswitch.com\/wp-json\/wp\/v2\/posts\/1602","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/skyswitch.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/skyswitch.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/skyswitch.com\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/skyswitch.com\/wp-json\/wp\/v2\/comments?post=1602"}],"version-history":[{"count":0,"href":"https:\/\/skyswitch.com\/wp-json\/wp\/v2\/posts\/1602\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/skyswitch.com\/wp-json\/wp\/v2\/media\/10501"}],"wp:attachment":[{"href":"https:\/\/skyswitch.com\/wp-json\/wp\/v2\/media?parent=1602"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/skyswitch.com\/wp-json\/wp\/v2\/categories?post=1602"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/skyswitch.com\/wp-json\/wp\/v2\/tags?post=1602"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}