I'll try to keep this brief.
I have Two SPA-112 at my work place (ATA1 and ATA2) and one SPA-112 at home (ATA3).
ATA1 Line1 -> PBX line 1 (DID-1)
ATA1 Line2 -> fax machine (DID-2)
ATA2 Line1 -> PBX line 2 (DID-1)
ATA2 Line2 -> PBX line 3 (DID-1)
The above registered at account 1, voip.ms. Forwarding rules at voip.ms set up so that inbound calls to DID1 go to ATA1 Line1, but get forwarded if busy to ATA2 Line1 then ATA2 Line2. ATA3 using DID3, registered to a different voip.ms account.
ATA1 is web-reachable, on a 4-digit port, admin login UN/PW was set to something other than admin/admin. ATA2 is not web-reachable. SPA112 has default user account (cisco/cisco) and either by design or fault in web UI, the name/pw can't seem to be changed nor can the account be disabled. User account can do a few things, among them set a forwarding number.
ATA3 is also web-reachable, 4-digit port, different IP (different ISP) than ATA1/ATA2.
All 3 ATA's did not have any of the 5 possible Cfwd services turned off. They are on by default.
I am just guessing at this next part. At some point on Dec 26/27, someone managed to log into ATA1 by using the correct port number and probably use the cisco/cisco user account to set a forwarding number on both lines (to a UK number). We didn't know it at the time, but on Dec 28 when PBX line 1 is picked up, we hear slow stutter dial tone for a few seconds. SPA112 will do that for at least 2 conditions: Line DND is set, or line-forward is set. Line can still be used to call out.
Incoming calls has new pattern: Instead of being picked up by the pbx upon first ring, caller hears 3 rings, then the pbx greeting. Incoming calls show coming in on line 2 on the phone display, not line 1. Only discovered on Dec 29 when looking at call logs, all incoming calls for previous 1.5 days show incoming/outgoing pair of entries. Incoming from source CID, outgoing from source CID to UK number at same time or 1 second later. Duration of outgoing call is zero (and zero cost). I figure that because of the forward-on-busy/unavailable, voip.ms is routing the call to ATA2 as intended, and the UK call is initiated but not terminated.
Dialing *73 on ATA line 1 and 2 (fax machine) disables or turns off forwarding (*73 will not disable DND). We did that on the evening of Dec 28. This must also clear the forwarding entry to the UK number in the ATA because we didn't see any forwarding entries in the ATA when we logged into it on Dec 29.
ATA3 (my home ATA) was also giving slow-stutter on both lines on Dec 28, and not ringing when called. But call logs don't show any forwarding was going on when it was being called. I reset the ATA and re-loaded config from file. As of last night, web-access to both ATA1 and ATA3 were disabled, and all 5 Cfwd services on all 3 ATA's were disabled.
Still want to know more about SPA112 User account - how to either change default name/pw or disable it completely. Can find nothing on the web about this issue with the user account.
One last thing. UK number being forwarded to was 442080XXXXXX. I look at wikipedia entry for UK phone number format, and can't correlate what I see there with this number. UK area codes seem to always have leading zero. This UK number is (I think) 44 2080 XXXXXX and hence area code is 2080? Can someone tell me what that number would look like if dialed within the UK, or what the per-minute cost would be for a voip.ms user?
The number seems to be owned/operated by DIDWW Ireland Limited. Google search for the number turns up nothing.
↧