Deskphones | Troubleshooting - Ghost/Phantom Calls
What is a Phantom call?
Phantom calls or commonly called ghost calls, are incoming calls in which when answered, there is no one on the other end of the call.
Receiving multiple ghost/phantom calls from is actually a result of malicious intent. "Hackers" use a program called SIP vicious to probe networks and compromise IP phones.
You can validate one of these attacks if your phone rings with a suspicious caller ID (Ex."100", "4001", etc.) but the calls do not show up in the RingCentral account's Call Logs. This means the call did not come through the RingCentral servers, and the attackers have found a way in to your network.
How to identify a Phantom call
Below are the characteristics of phantom calls:
• These calls would endlessly ring IP phones and usually show up with 3 or 4-digit Caller ID (Ex. 101, 4001, etc.)
• These calls only affect VOIP devices and will never reach regular telephones or mobile phones.
• These calls may sometimes show up a CallerID Name SIPVicious or something similar.
• These calls do not show up in the account's Call Logs.
How can you stop these kinds of SIP attacks?
The only stable resolution is to lock down the SIP ports on the router. The concept is to only allow inbound and outbound traffic on IP phones to go to and come from RingCentral IP addresses. You may need the help of an IT professional to do this.
The IP ranges you should be accepting traffic from are as follows:
To lock down the SIP ports on the router, your router must have a functionality commonly referred to as Access Control List (ACL). This functionality allows a user to specifically set local IP Addresses to only communicate to the RingCentral IP addresses.
You can view the latest recommended network configuration settings by clicking on these links