This is a copy of an email I have sent to Draytek AND Draytel support: anyone have anything to add?
I have installed at the end of last year a 2820IPPBX with a client, with one Vigorphone 350 set up as a VOIP test for a possible migration to an all VOIP system. They complained last week that their call credit with Draytel (their only outgoing trunk of any type) was being sapped rapidly.
On examining the call records, all the calls, all to international destinations, were coming from x901, which was set up as the analog extension in index 50. I am sure that I never enabled either the Analog extension nor the ISDN extension in indexes 49 and 50, but they were enabled when I checked. Are these extensions enabled or disabled by default?
Following this discovery I did the following:
Checked that there was no analog phone plugged into the router - there was none
Changed the Draytel SIP password and entered the new one in the router
Changed the router admin password
Disabled indexes 49 and 50.
This was done on the 20th Jan
HOWEVER, from the attached screenshot, (not attached here, but it shows loads of calls being made to dodgy countries from x901, both before and after the changes I have outlined here) outgoing calls are still being made from 901, which is disabled in the extension settings on index 50 (ie analog phone) and has been since the morning of Jan 20th. The call failures are possibly due to there being no credit on the account, on my advice, until this is sorted.
How on earth can this be happening? There seems to be a backdoor thing going on here. I am a little peeved that Draytel informed us all that they had not had any actual incidences of this in their advisory email, when I had already reported this to them.
