Ghost calls and phantom ringing on SIP phones

See also

Sources

1. 1
   8x8 attributes ghost calls to external port scans, usually on port 5060, in which a scanner sends an INVITE and, if the phone responds, tries to hijack it to place calls.field report

   Troubleshooting Ghost Calls · Cause section · Checked 2026-10-14
2. 2
   For consumer-grade routers 8x8 advises forwarding port 5060 TCP and UDP to an unused IP address outside the DHCP range, then setting the local SIP port on each phone if the calls continue.

   Troubleshooting Ghost Calls · Resolution, consumer-grade routers paragraph · Checked 2026-10-14
3. 3
   For phones on a flat network behind a business firewall, 8x8 advises dropping inbound traffic for unestablished sessions.

   Troubleshooting Ghost Calls · Resolution, business or enterprise firewalls paragraph · Checked 2026-10-14
4. 4
   8x8 says that if its steps fail the router likely needs replacing because faulty NAT can leave open pinholes, and that some routers such as the AT&T modem router cannot be configured to fix the problem.field report

   Troubleshooting Ghost Calls · Additional Information section · Checked 2026-10-14
5. 5
   8x8 describes ghost calls as desk-phone calls showing at least two of: odd caller IDs often 100 or 1000, ringing that never reaches voicemail, and dead air when answered.field report

   Troubleshooting Ghost Calls · Symptom section · Checked 2026-10-14
6. 6
   8x8 states that ghost calls do not appear in its Call Detail Records.

   Troubleshooting Ghost Calls · Resolution, business or enterprise firewall paragraph · Checked 2026-10-14
7. 7
   For phones on a separate voice VLAN, 8x8 advises blocking all traffic not to or from the 8x8 subnets listed in its X Series technical requirements.

   Troubleshooting Ghost Calls · Resolution, business or enterprise firewalls paragraph · Checked 2026-10-14
8. 8
   A ringing call that is absent from the hosted provider's or PBX's call records most likely reached the phone directly rather than through the provider, which points to scanning or direct IP traffic.inferred

   Troubleshooting Ghost Calls · Resolution paragraph (CDR statement) combined with sipgate opening paragraphs (network bypass) · Checked 2026-10-14
9. 9
   On Grandstream GRP phones, Accept Incoming SIP from Proxy Only under Account X > SIP Settings > Security Settings rejects calls whose Request-URI address does not match the account's SIP server.

   GRP Series – Security Guidelines · SECURITY FOR SIP ACCOUNTS AND CALLS > Anonymous/Unsolicited Calls Protection · Checked 2026-10-14
10. 10
    On Grandstream GRP phones, Anonymous Call Rejection under Account X > Call Settings rejects anonymous callers with 486 Busy Here.

    GRP Series – Security Guidelines · SECURITY FOR SIP ACCOUNTS AND CALLS > Anonymous/Unsolicited Calls Protection · Checked 2026-10-14
11. 11
    On Grandstream GRP phones, Authenticate Incoming INVITE set to Yes challenges incoming INVITEs with SIP 401 Unauthorized.

    GRP Series – Security Guidelines · SECURITY FOR SIP ACCOUNTS AND CALLS > Anonymous/Unsolicited Calls Protection · Checked 2026-10-14
12. 12
    On Grandstream GRP phones, setting Disable Direct IP Call to Yes under Settings > Call Features blocks calls made directly to the phone's IP address on all ports.

    GRP Series – Security Guidelines · SECURITY FOR SIP ACCOUNTS AND CALLS > Anonymous/Unsolicited Calls Protection · Checked 2026-10-14
13. 13
    On Grandstream GXP phones, setting Accept Incoming SIP from Proxy Only to Yes makes the phone check the SIP address in the Request-URI of incoming SIP messages and reject calls that do not match the account's SIP server.

    GXP Series – Security Guidelines · SECURITY FOR SIP ACCOUNTS AND CALLS > Anonymous/Unsolicited Calls Protection > Additional SIP security settings · Checked 2026-10-14
14. 14
    Grandstream states that GXP phones have a built-in mechanism that detects spam SIP calls and stops them from ringing the phone, without naming a separate setting for it.

    GXP Series – Security Guidelines · SECURITY FOR SIP ACCOUNTS AND CALLS > Anonymous/Unsolicited Calls Protection · Checked 2026-10-14
15. 15
    On Grandstream GXP phones, Check SIP User ID for Incoming INVITE rejects INVITEs whose Request-URI user ID does not match the account's SIP User ID, and enabling it also disables direct IP calling.

    GXP Series – Security Guidelines · SECURITY FOR SIP ACCOUNTS AND CALLS > Anonymous/Unsolicited Calls Protection > Additional SIP security settings · Checked 2026-10-14
16. 16
    Grandstream GXP phones use local SIP port 5060 for Account 1 and 5062 for Account 2 by default, with further accounts following the same pattern.

    GXP Series – Security Guidelines · SECURITY FOR SIP ACCOUNTS AND CALLS > Protocols and Ports · Checked 2026-10-14
17. 17
    Grandstream's GXP security guidelines recommend turning off SIP ALG on the router because it can modify SIP packets and cause registration or call failures.

    GXP Series – Security Guidelines · SECURITY GUIDELINES FOR GXP DEPLOYMENT · Checked 2026-10-14
18. 18
    Grandstream's GXP security guidelines say the firewall need not use the default port and an administrator can map a different external port to the phone's SIP port 5060.

    GXP Series – Security Guidelines · SECURITY GUIDELINES FOR GXP DEPLOYMENT · Checked 2026-10-14
19. 19
    On Grandstream GXP phones, Validate Incoming SIP Messages rejects incoming messages that lack the caller ID and CSeq headers it checks.

    GXP Series – Security Guidelines · SECURITY FOR SIP ACCOUNTS AND CALLS > Anonymous/Unsolicited Calls Protection > Additional SIP security settings · Checked 2026-10-14
20. 20
    HP Poly device-security guidance names voIpProt.SIP.requestValidation.x.method set to source with voIpProt.SIP.requestValidation.x.request set to INVITE as the way to restrict incoming INVITEs to the registrar.

    Best Practices HP Poly Device Security for Poly Voice Software · unknown page; PDF text not extracted · Checked 2026-10-14
21. 21
    Field guidance for Yealink phones is to disable Allow IP Call under Features > General Information, because it lets the phone respond to calls from any IP address to any number.field report

    Yealink “ghost” phone calls · blog post, settings list · Checked 2026-10-14
22. 22
    Field guidance warns that Yealink's Accept SIP Trust Server Only must be left off for certain SIP providers, though it should be enabled wherever possible.field report

    Yealink “ghost” phone calls · blog post, settings list · Checked 2026-10-14
23. 23
    RFC 3261 sets the default port for sip: URIs carried over UDP, TCP or SCTP to 5060.

    RFC 3261 — SIP: Session Initiation Protocol · Section 19.1.2, Table 1, footnote (1); also Section 18.1.1 · Checked 2026-10-14
24. 24
    RFC 3261 sets the default port to 5061 for sip: over TLS over TCP and for sips: over TCP.

    RFC 3261 — SIP: Session Initiation Protocol · Section 19.1.2, Table 1, footnote (1) · Checked 2026-10-14
25. 25
    RFC 3261 says SIP elements on public-facing hosts SHOULD be deployed in an administrative domain with defensive operational policies, with edge bastion hosts keeping internal SIP hosts free of superfluous messaging.

    RFC 3261 — SIP: Session Initiation Protocol · Section 26.3.2.4 DoS Protection · Checked 2026-10-14
26. 26
    RFC 3261 identifies the risk of attackers using hapless SIP UAs or proxies to generate denial-of-service traffic aimed at a target.

    RFC 3261 — SIP: Session Initiation Protocol · Section 26.1.5 Denial of Service and Amplification · Checked 2026-10-14
27. 27
    SIPcity advises allowing traffic to port 5060 only from its public voice proxy range 103.55.116.0/24 and denying all other traffic to that port.

    Ghost Calls · Ghost Calls page, firewall fixes · Checked 2026-10-14
28. 28
    SIPcity attributes ghost calls to the SIPVicious scanning tool sending SIP INVITE messages to port 5060, which makes a reached IP phone ring with silence at pickup.disputed

    Ghost Calls · Ghost Calls page, cause paragraph · Checked 2026-10-14
29. 29
    SIPcity describes ghost calls as annoying but generally harmless on properly configured systems and says they do not cause financial loss.field report

    Ghost Calls · Ghost Calls page, harm paragraph · Checked 2026-10-14
30. 30
    SIPcity states that Yealink phones provisioned through its Device Provisioning service have the ghost-call protections enabled by default.

    Ghost Calls · Ghost Calls page, Yealink settings section · Checked 2026-10-14
31. 31
    sipgate advises that moving the phone to an alternative SIP port such as 44160 is often not enough on its own to stop direct IP (SPIT) calls.field report

    How do I block Direct IP (SPIT) calls from numbers like 100, 1001, or IP addresses? · additional measures list · Checked 2026-10-14
32. 32
    sipgate states that direct IP calls to a phone bypass the sipgate number and network, so blocking them requires changes to the customer's network and phone settings.

    How do I block Direct IP (SPIT) calls from numbers like 100, 1001, or IP addresses? · opening paragraphs · Checked 2026-10-14
33. 33
    sipgate calls unsolicited direct IP calls from numbers like 100 or 1001 SPIT, spam over Internet telephony.

    How do I block Direct IP (SPIT) calls from numbers like 100, 1001, or IP addresses? · page title and opening paragraph · Checked 2026-10-14
34. 34
    Enable Security states that SIPVicious OSS is also known as friendly-scanner.

    SIPVicious OSS · SIPVicious OSS page, opening paragraph · Checked 2026-10-14
35. 35
    SIPVicious was first published in 2007.

    SIPVicious OSS · SIPVicious OSS page, history paragraph · Checked 2026-10-14
36. 36
    Besides svmap, SIPVicious OSS includes svwar to identify working extensions on a PBX and svcrack to crack SIP digest authentication passwords.

    EnableSecurity/sipvicious: SIPVicious OSS is a set of security tools that can be used to audit SIP based VoIP systems · README, The tools section · Checked 2026-10-14
37. 37
    On Snom phones, filter_registrar set to on makes the phone ignore SIP packets from sources other than the registrar or proxy.

    filter_registrar · filter_registrar page, Description · Checked 2026-10-14
38. 38
    Snom documents the default value of filter_registrar as on, for security reasons.

    filter_registrar · filter_registrar page, Default value field · Checked 2026-10-14
39. 39
    Snom advises disabling filter_registrar for call flows in which SIP traffic does not come only through the proxy.

    filter_registrar · filter_registrar page, Description · Checked 2026-10-14
40. 40
    With Snom filter_registrar on, only the IP address the phone used to send REGISTER is accepted, even when the registrar or outbound proxy FQDN resolves to several IP addresses.

    filter_registrar · filter_registrar page, Description · Checked 2026-10-14
41. 41
    The Snom web UI exposes filter_registrar as Filter packets from Registrar under Advanced > QoS/Security > Security.

    filter_registrar · filter_registrar page, Web UI field · Checked 2026-10-14
42. 42
    Enabling a phone's accept-only-from-proxy filter is likely to break any legitimate SIP traffic that does not arrive from the registered proxy, including direct IP calls, intercom or paging peers and some multi-node provider platforms.inferred

    filter_registrar · filter_registrar page, Description; read with Grandstream GXP Additional SIP security settings and Yealink W80 p217 · Checked 2026-10-14
43. 43
    By default SIPVicious svmap scans with the SIP OPTIONS method, not INVITE.

    SVMap Usage · SVMap Usage, Method section · Checked 2026-10-14
44. 44
    SIPVicious svmap is a scanner that identifies SIP devices and PBX servers on a target network.

    SVMap Usage · SVMap Usage, introduction · Checked 2026-10-14
45. 45
    The SIPVicious svmap documentation states that scanning with INVITE as the method can make all the phones on a network ring at the same time.

    SVMap Usage · SVMap Usage, introduction feature list and Method section · Checked 2026-10-14
46. 46
    svmap's -m / --method option changes the scan request method, with REGISTER and INVITE given as examples.

    SVMap Usage · SVMap Usage, usage text and Method section · Checked 2026-10-14
47. 47
    A VoIP Supply post attributes ghost calls on a Polycom VVX300 to UPnP or SIP ALG enabled on the router.disputed

    The Polycom VVX300: Where did the ghost calls come from? · blog post, cause paragraph · Checked 2026-10-14

Documents

Cite this page

WarmTransfer. (2026, October 14). Ghost calls and phantom ringing on SIP phones. WarmTransfer. https://warmtransfer.net/knowledge/ghost-calls-phantom-ringing

@misc{warmtransfer-ghost-calls-phantom-ringing,
  title  = {Ghost calls and phantom ringing on SIP phones},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/ghost-calls-phantom-ringing},
  note   = {Verified 2026-10-14}
}