fake numbers have called others in our CallManager randomly

[abuahmed.sd]

Hello,

I have CUCM version 11.5 one publisher & two other sub-servers, we have more than 1000+ DN in our CallManager

suddenly I found some fake numbers have called others in our CallManager randomly.

Firstly, from where these fake numbers can come out?

And how can I eliminate these fake numbers from our CallManager?

Any one can help...

[Nithin Eluvathingal]

If fake calls are coming through the gateway PRI/SIP you can block such calls using translation. Search on community you will find a large number of discussion regarding this.

2.12.0.0

[abuahmed.sd]

Thanks for your reply, I think is not coming from outside, it looks like our number in some calls and it looks like fifth number (our schema is four numbers), and others look like user!! 
I attached the image for some calls

[Jonathan Schulenberg]

You’ll need to pull CDR records and potentially SDL traces to sort this out. The first question needs to be what originated the call; I can think of at least three possibilities: PSTN gateway (most lilely), auto-registration (which would imply malware is present on the network to exploit that), and Expressway B2B calls. Remediation options will vary depending on the cause.

[abuahmed.sd]

Thanks for your reply @Jonathan Schulenberg 

I have an issue with the CDR report too, this message comes out when I want to get the report.

[Jonathan Schulenberg]

What research have you done for the CAR error? What have you checked/tried already? A quick Google search for "Cisco CDR CAR 10011 error" returned several Cisco defects that impact 11.5 and other posts here on the forums. The workaround on one of those defects suggests that restarting Cisco Tomcat may temporarily resolve the issue. Others have no workaround but appear to have an 11.5 fixed in release, either an SU or ES.