<div dir="ltr">I don't see the full syslog here, but check to see if there's a call forward number set in the SPA8000? We recently saw an instance where someone set a call forward on an SPA3102, dialed into the 3102 via a different number, and then it was forwarded back out. <div>
<br></div><div>-Gabe</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Sep 30, 2013 at 1:18 AM, fs <span dir="ltr"><<a href="mailto:fs@voice2net.ca" target="_blank">fs@voice2net.ca</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I do not know if anyone has seen this. I use spa8000 ata's to provide sip<br>
trunking to a freeswitch an onwards. Over the past three days I have had<br>
someone hacking into the spa8000 and relaying international calls back out.<br>
I have no ideal how they do it and cannot find any info in the traces that<br>
indicates where the call came from. I have seen a note on cisco's web site<br>
about someone else complaining about this but no resolution.<br>
<br>
My syslog from the spa8000 starts like so.<br>
<br>
Syslog LOCAL2.DEBUG: M0: <a href="http://Calling:01137744616847@sample.switch.ca:0" target="_blank">Calling:01137744616847@sample.switch.ca:0</a>\n<br>
Syslog <a href="http://LOCAL0.INFO" target="_blank">LOCAL0.INFO</a>: M0: [2]->xx.xxx.xx.xx:5060(985)\n<br>
Syslog <a href="http://LOCAL0.INFO" target="_blank">LOCAL0.INFO</a>: M0: [2]->xx.xxx.xxx.xx:5060(985)\n<br>
Syslog INVITE <a href="mailto:sip%3A01137744616847@sample.switch.ca">sip:01137744616847@sample.switch.ca</a> SIP/2.0 {etc}<br>
<br>
Any thoughts or ideas would be REALLY appreciated.<br>
<br>
Darcy Primrose<br>
<br>
<br>
_________________________________________________________________________<br>
Professional FreeSWITCH Consulting Services:<br>
<a href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a><br>
<a href="http://www.freeswitchsolutions.com" target="_blank">http://www.freeswitchsolutions.com</a><br>
<br>
FreeSWITCH-powered IP PBX: The CudaTel Communication Server<br>
<a href="http://www.cudatel.com" target="_blank">http://www.cudatel.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
<a href="http://wiki.freeswitch.org" target="_blank">http://wiki.freeswitch.org</a><br>
<a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
</blockquote></div><br></div>