Nonstop phantom calls from PP1 / OBiTALK Service

[jsg68]

No more calls for me, either, after changing the call route to just {}.

[Sheffield_Steve]

Why have you opened up port 10000?

The only port number that exposes my OBI to the outside word is UDP 10000, and disabling that port in my router did not stop these calls.

[jsg68]

Why have you opened up port 10000?

I can't speak for him, but I couldn't find any way to get my device registered and working without manually opening UDP port 10000.  Absent that, the site would never find it to complete registration.

(Don't ask me why opening this port isn't handled via UPnP.  I'm using a late model router (TP-Link AC4000) that supports UPnP, but the OBI 200 apparently doesn't configure the port forward on its own.)

[Mike1111111]

I thought this port was required. Many years ago I looked up the ports I needed to open in my router to allow the OBI to work and port UDP 10000 was the only port. I thought this was listed in the setup FAQ. If it is not needed, I will close this port entirely. I do not have UPnP enabled.

I bought and added a second OBI to my network last week, and I did not open up any ports for that. I was able to set it up, register it, and make and receive calls on it without opening up any port in the router. So perhaps port 10000 is no longer needed, or perhaps it is only needed for certain features that I am not using. The answer would benefit from understanding what the "OBiTALK Service" does, since that is what is using the port. My second OBI did not experience the phantom call problem this morning.

Why have you opened up port 10000?

[SergeL]

My OBi behind NAT, no directly open ports at all. I believe that this issue is related to OBitalk service itself, none of my SIP services registered those numbers in their call logs.

[MonkeyDad]

I also experienced this issue with very similar timing. My Obi is behind a router. The calls started at 23:02 EST. Stopped, then started going off the hook at 3:16 AM.

To try to claim that this many people with very similar timing isn't an issue with ObiTalk seems naïve at this point. And I've had X_AcceptSipFromRegistrarOnly enabled the whole time.

[JohnPD]

Same problem here, exact same timing as MonkeyDad... did the {(xxxxxxxxx):ph} trick, worked flawlessly, but there's clearly something wrong on ObiTalk's side.  Every weird call received from impossible numbers, all prefixed with ob37*: 8950, 1900005642, 910000005642, 9720000005642.

[Sire]

Just curious as to what are these folks up to? Anyone know?

Last month I was hit by SIP attacks and modified the settings to block those.

Yesterday I got hit by these PP1 attacks... almost non-stop ringing. Resolved by setting the incoming route to {}.

As you can see from the attachment, they are trying to pass in various combinations of likely-used passwords (though luckily I would never use that sort of password).

Just wondering what are they attempting to do?

[rogerkali]

I tried changing this field, but like the enable checkbox, my change appears to revert to the default after the reboot. I was making the changes using the device IP address admin page. I will try changing this using the OBitalk portal to see if that helps.

[drgeoff]

I tried changing this field, but like the enable checkbox, my change appears to revert to the default after the reboot. I was making the changes using the device IP address admin page. I will try changing this using the OBitalk portal to see if that helps.

The portal will always override locally made changes unless OBitalk Provisioning is disabled.