This is a result of external sources trying to exploit possible PTSN trunks in users environments, it's being seen by a lot of people that have video or telephone systems that are accessible on the public internet. You can read a bit more about it in this discussion: sourceh323idcisco-incomingcalls. Only thing that can be done is if you're using a call control server such as VCS you can create a call policy to block the call attempts (there is one I created in the linked discussion), or if the system is stand alone as it appears you're is, block all incoming IPs traffic to the codec except those you trust to allow in. You could get the IP by going through the codec's call history, however that won't help as the source IP changes constantly.
