Person says that my company is calling them?

[mleitao]

I got a call from someone saying that we have been calling there cell number. So I did a logsys on there number and in fact we have been calling them! But I'm not sure how to locate the source of the calling. Here a partial report, I x'd out the outgoing call, the first chunk of the log is when they called to report the issue. I think it has to do with extension 8812/8813

 07/08 16:28:57  0000:00:31 8813         4848XXXXX                A T20       
                           001   18813                                   A001299
1 A                                                                             
 07/08 15:43:42  0000:02:03 T1      0020 360 390                     8812       
                           001   4848XXXXX           7007               A001289
5 A C0012839                                                                   
 07/08 15:41:49  0000:01:33 T1      0021 398 349                     449       
    X 360                  001   4848XXXXX           7007               C001283
9 A A0016728                                                                   
 07/08 15:41:00  0000:00:28 T1      0002 7007 390                   S8811       
    X 398                  001   4848XXXXX           7007               A001672
8 A                                                                             
 07/08 15:40:01  0000:00:29 8813         4848XXXXX                A T8         
                           001   18813                                   C001159
8 A                                                                             
 07/08 11:41:16  0000:00:10 8813         4848XXXXX                A T23       
                           001   18813                                   A001608
2 A                                                                             
 07/08 11:25:25  0000:00:16 8812         4848XXXXX                  T16       
                           001   18812                                   A001726
0 A                                                                             
 07/07 11:34:26  0000:00:16 8813         4848XXXXX                 T13       
                           001   18813                                   A001271


When I do a LOCATE EXTENSION 8812

I get
VM Port : 713                                                                   
Circuit Location : 1 4 27 12 1                                                 
Extension : 8812                                                               
Zone ID: 1

I'm not sure what 713 refers to, I have checked the VM that it refers to, to see if there is call forwarding to the number, there is call forwarding but to a completely different number. If I goto Voice Mail->System Settings -> VM Ports I see the extension 8812/8813 there but the port id's are 12/13. Does anyone have any ideas on where to track this down?

Thanks Michael

[mleitao]

I've done a STATE EXTENSION 8812, and I get

  Location    | Device               | State         |  Owner  | ID   |Status   
----------------------------------------------------------------------------   
 1 4 27  12  1| Superset 4150        |Idle           |         |      |         
 1 4 27  12  2| Unassigned           |Not applicable |         |      |         
 1 4 27  12  2| Alternate Codec      |Idle           |         |      |         
----------------------------------------------------------------------------

I'm don't have any Superset 4150, so I'm not sure where this info is coming from

[x-man]

Superset 4150 is Mitel speak for a voicemail port.

[ralph]

It would appear that you have a mailbox that is dialing out.
You can start your troubleshooting by downloading the VM logs.

FTP into your 3300 using FileZilla.   Change to directory /vmail/c/voxdrv.   Download files diag.dat and diag.sav.

Ralph

[x-man]

Do you know what 7007 is? Is it anything related to your system?

[mleitao]

@X-Man I think 7007 refers to our main extension since thats our last 4 digits.

@Ralph, I used filezilla and have found many entries like this
07/07 11:18:57 INFO    1419-12 pg:710/94848XXXXXX/48

I'll look into extension 710

[ralph]

Yes.  That shows that something in your vm is doing it.
Do you have a mailbox for 1419?
I'd bet that's the problem box.

Ralph

[mleitao]

@Ralph, I don't have a VM of 1419
I did a state extension 1419 LOCATE: Invalid or nonexistent extension number or id number.   

[mleitao]

@Ralph, I found it the VM for 710 had Message notification Enabled with the number pointing to the 484XXXXXXX number.
Thanks a lot for your help
Michael

[x-man]

Hope this isn't the start of a hack attempt. have you queried if the owner of 710 put this message notification on?