Ghost calls from Ext 1001 and 1100. No one on the line

[ilikebirds12]

We have 3 offices, each with their own KX NCP500 / TDA 100 / TVA 50

There is a SIP Gateway that connects the three offices, with extension in the 100's, 200's, and 300's.

However lately 2 of our offices are getting random phone calls from Ext 1001 and 1100 but there's nothing on the line.

How do I find where those extensions are coming from?

 

[obtsystems]

they could be message waiting notification rings, are they key sets or analogue phones

 

[ilikebirds12]

Yea I think it's someone trying to hack in and make outbound calls through the VM.
I've turned of Remote call forwarding.