HOWTO Ghost Calls
Description I'm getting strange calls to my phone but PBXware show no CDRs
Generally ghost calls are calls directed at devices themselves, not stemming from asterisk.
Some phones were found to be listening on public ports (usually they are listening to standard sip ports 5060-5069) so the attackers can locate them and send invites directly to the devices.
There is nothing that can be done on server side as this sip traffic does not pass through PBXware.
Depending on manufacturer phones might have the option to restrict sip traffic to registered IP's only, for example:
Grandstream instructions:
http://www.grandstream.com/support/faq/troubleshooting#Q15
Yealink instructions:
https://support.yealink.com/faq/faqInfo?id=559
Polycom instructions: