/
Ghost Calls & SIP Scanners

Ghost Calls & SIP Scanners

Overview

If you are seeing missed calls from what appear to be internal extensions (such as 100, 101, or 1000), receiving calls you cannot answer, or picking up calls with no one on the other end, you are likely experiencing what are commonly referred to as ghost calls. These are not robocalls; ghost calls are the result of automated SIP scanning attacks targeting your IP phone directly, not your phone number. Because there is no real person on the other end, you will never hear audio, and the calls typically cannot be answered in a meaningful way.

Ghost calls most commonly affect IP phones registered through the internet on home or small office networks. They can occur at irregular intervals or at a very high frequency and always bypass the Sharpen network entirely; the attack goes directly from the scanner to your IP phone.

What Is SIP Scanning?

SIP scanning is an automated method used to probe IP address ranges for VoIP endpoints, such as IP phones, PBXs, and softswitches, listening on the standard SIP port (5060). The scanner sends a SIP INVITE or OPTIONS message to the target. When an IP phone receives an INVITE, it rings, which is the ghost call you experience.

The scanner then collects information from the response and attempts to brute-force access to the registered SIP server by testing sequential account numbers, usernames, and passwords. Networks that allow all inbound traffic on port 5060 are the most vulnerable to this type of attack.

Ghost calls vs. robocalls: Robocalls are automated outbound calls placed to real phone numbers, usually for telemarketing or scam purposes; they target end users. Ghost calls are an infrastructure-level attack targeting your SIP device directly. The symptoms can feel similar (unexplained, unwanted calls), but the cause and solution are entirely different.

Why Do Attackers Do This?

The goal of a SIP scanning attack is to gain unauthorized access to a VoIP system capable of placing unlimited outbound calls. Once access is obtained, attackers use it to commit toll fraud, artificially generating a high volume of calls to expensive international routes and collecting revenue from those calls.

Prevention Options

Ghost calls can be stopped by controlling which SIP traffic your phone or network accepts. The options below cover the most common approaches depending on your setup.

Option 1 — Enable VoIP Protection on a Polycom Phone

If you are using a Polycom phone, the simplest resolution is to enable the built-in VoIP Protection setting.

Navigate to Admin > Configuration > Extensions, select the extension in use, and enable the VoIP Protection option under Advanced settings.

Option 2 — Identify and Block the Attacker's IP Address

This is a short-term fix, as attackers can change their source IP address. However, it is effective if you need a quick resolution while a longer-term fix is being configured.

  1. Use Wireshark or your firewall/router logs to identify unwanted inbound traffic on SIP port 5060.

  2. Block the identified IP address at your firewall or router.

Note: Sharpen's IP ranges are subject to change. If you need to confirm which IP addresses are safe to allow while blocking others, contact Sharpen Care before making firewall changes.

Option 3 — Block by SIP User-Agent

Calls originating from the Sharpen platform will identify with a User-Agent of Fathom Voice vX.X.X. You can configure your firewall or router to block traffic from known SIP scanning User-Agents, or alternatively whitelist only the User-Agents you trust.

The following User-Agents are commonly associated with SIP scanning tools:

sipcli, gulp, sipvicious, sipv, sip-scan, smap, sipsak, friendly-request, sundayddr, VaxIPUserAgent, friendly-scanner, VaxSIPUserAgent, iWarsip, siparmyknife, CSipSimple, Test Agent, SIVuS

Option 4 — Accept Traffic from the Registered SIP Server Only

This is the most robust long-term solution. Polycom and Yealink phones both have a configuration option that restricts the phone to only accept SIP traffic from the server it is currently registered to, blocking all other sources.

Note: Sharpen's SIP infrastructure is dynamic and redundant, so the registration point can change over time. This approach accounts for that by using the phone's own current registration rather than a static IP.

Polycom

  1. On the phone, navigate to Settings > Status > Network > TCP/IP Parameters and note the phone's IP address.

  2. In a browser, navigate to https://[phone IP address] (e.g., https://10.0.5.68).

  3. Proceed past the browser security warning to reach the web configuration page.

  4. Log in using Admin as the username and 6311 as the password.

  5. Navigate to Utilities > Import & Export Configuration.

  6. Download the https://drive.google.com/file/d/1qORR_6GxsUE-qfdjkSPSCaX5aqZ9iYvT/view?usp=sharing file.

  7. Click Choose File, select the downloaded file, and click Import.

  8. Reboot the phone.

Yealink

  1. On the phone, press the OK button from the home screen to view the phone's IP address.

  2. In a browser, navigate to https://[phone IP address] (e.g., https://10.0.5.68).

  3. Proceed past the browser security warning to reach the web configuration page.

  4. Log in using admin as both the username and password.

  5. Navigate to the Features tab, then select General Information.

  6. Find the Accept SIP Trust Server Only setting and set it to Enabled.

  7. Click Confirm and reboot the phone.

Related Articles