I don't see the full syslog here, but check to see if there's a call forward number set in the SPA8000?  We recently saw an instance where someone set a call forward on an SPA3102, dialed into the 3102 via a different number, and then it was forwarded back out.  

-Gabe


On Mon, Sep 30, 2013 at 1:18 AM, fs <fs@voice2net.ca> wrote:
I do not know if anyone has seen this.  I use spa8000 ata's to provide sip
trunking to a freeswitch an onwards.  Over the past three days I have had
someone hacking into the spa8000 and relaying international calls back out.
I have no ideal how they do it and cannot find any info in the traces that
indicates where the call came from.  I have seen a note on cisco's web site
about someone else complaining about this but no resolution.

My syslog from the spa8000 starts like so.

Syslog LOCAL2.DEBUG: M0: Calling:01137744616847@sample.switch.ca:0\n
Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xx.xx:5060(985)\n
Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xxx.xx:5060(985)\n
Syslog INVITE sip:01137744616847@sample.switch.ca SIP/2.0 {etc}

Any thoughts or ideas would be REALLY appreciated.

Darcy Primrose


_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org