We got two phone calls within 5 minutes of each other at 4AM this morning from a caller with a CID of "asterisk". When we answered, there was no one there in both cases. This has happened before, also in the middle of the night. (Obviously from someone with an asterisk pbx.)

The calls didn't appear in call history of the CP, so I couldn't find a way to block them for the future.

I opened a ticket, and the response was that the calls didn't come from Voipo's network - that someone is port scanning large blocks of IP addresses from my ISP, looking for open PBX's to place free phone calls through.

They said there was nothing they could do, and I should just ignore it until they stop the scanning.

I really need a better response than that, given that these calls come in the middle of the night when we're sleeping. It's hard to ignore a ringing phone at 4AM. And I can't just put it in DND overnight.

Is anyone else experiencing this?

We use a Grandstream HT502 ATA, and it's installed in front of the router. Because of it's placement in front of the router, I can't filter or monitor for tracing purposes, caller's IP addresses that go to the ATA.

Does the Grandstream support any kind of firewall that would restrict IP addresses that it would respond to? Or, lacking that, is there any setup parameter that would say "only link and respond to IP address w.x.y.z"? And does the Grandstream support syslog, so I could at least log the caller's IP address and make his/her life miserable in the middle of THEIR sleep?

I would just move the ATA behind the router and let the router handle the filtering, but the reason we have the Grandstream in the first place is we had major problems with the previous Linksys ATA behind the router (no audio, dropped calls, etc.) which have all been completely resolved by putting the ATA in front of the router.

Of course, then it's exposed for all the world to take a whack at it.