suspicious calls on a VoIP trunk scanning a range of extensions

[markukug]

We've got the following phenomenon on our CM 7.0.0.2.0-SP2.
On a VoIP-Trunk (terminates as E1/DS1) we get suspicous calls which seem to try to scan through a range of numbers.

list trace tac output:

14:32:35 TRACE STARTED 03/20/2019 CM Release String cold-00.0.441.0-22684
14:33:11 Calling party trunk-group 2 member 1 cid 0x3b9b
14:33:11 Calling Number & Name 2001 NO-CPName
14:33:11 active trunk-group 2 member 1 cid 0x3b9b
14:33:11 dial 0*91118 route:ARS
14:33:11 term trunk-group 2 cid 0x3b9b
14:33:11 idle trunk-group 2 cid 0x3b9b

Please find also a "definity analyzer output" attached. According to this the calling number is 2001 and the called number is 911180014698931824. It seems that the 1st 5 digits are somehow translated as extension which is then call within our numbering plan.

Does anyone have an idea how we can get rid of these calls? We currently have that trunk set "BUSY" because it's used as backup only. So we can live without it for the moment.

Thanks in advance

 

[markukug]

Our provider had to reconfigure the firewall of the "Patton" -->

Diese Pakete waren in der Firewall vom Patton nicht berücksichtig worden, daher sind sie durchgekommen.

Now the problem has gone 　

 

[cal3500]

i'm having a similar issue

From (xxxx PBX extension)@(xx.xx.xx.xx SBCoutside interface)
To 0046171121674@(xx.xx.xx.xx SBC outside interface Source IP 185.53.88.161(Cloud star Netherlands)