[Freeswitch-users] SIP attack SPA2102

[Miha]

Hi,

last night we noticed SIP attack from one of our costumar. Interesting 
thing is that the call come from Linksys SPA2012 which was behind NAT. 
The port forward was made for web access(xxx.xxx.xxx.xxx:8099).

How it is possible do call from SPA2012 (relay calls)? I am looking at 
SPA but do not see any of that options. How SIP traffic could be send to 
SPA from which calls was send as there was no SIP port fwd on router?

The device from which calls was send is SPA2012.

THank you very much for all explenation!!!
Miha