I do not know if anyone has seen this. I use spa8000 ata's to provide sip trunking to a freeswitch an onwards. Over the past three days I have had someone hacking into the spa8000 and relaying international calls back out. I have no ideal how they do it and cannot find any info in the traces that indicates where the call came from. I have seen a note on cisco's web site about someone else complaining about this but no resolution. My syslog from the spa8000 starts like so. Syslog LOCAL2.DEBUG: M0: Calling:01137744616847@sample.switch.ca:0\n Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xx.xx:5060(985)\n Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xxx.xx:5060(985)\n Syslog INVITE sip:01137744616847@sample.switch.ca SIP/2.0 {etc} Any thoughts or ideas would be REALLY appreciated. Darcy Primrose