Rogue VoIP registration

[jlaval]

I have a VoIP extension that keeps trying to register with my IPO 500v.2 9.1.2.0 in Toronto. We don't have an extension setup with this Extension number. The VoiP client IP address is in Europe. Does anyone know how to block a specific extension from trying to register with IPO?

[wellington35]

The initial registration requests come from the IP Phones not form the IP Office. To stop an IP Phone from sending registration requests out to the Call Server you must erase its values back to default or modify the 46xxxSettings file.

[furrerm]

What WAN IP is the traffic coming from? Is it in teh US? Are you being hacked?

[jlaval]

The IP address is 212.129.27.34 and it looks like it is registered to a company in the Netherlands.

[zakabog]

Do you have a firewall in front of your IP Office or are you just allowing all SIP traffic through on port 5060? If you allow everything to hit the IP Office on 5060 you'll see a lot of messages like this as various bots around the world attempt to hack your system to register a phone and make free phone calls.