Possible SIP scanner trying to hack my phone system?

[Liptonbrisk]

If you get an OBi200 or OBi202, we can stop this problem very quickly.
But if you have security issues on your network, those will still exist, despite your phones
no longer ringing constantly.

There's a lot of things being assumed about your home network anyway.
Is your wi-fi secure? I see open wi-fi connections in my neighbourhood. Anyone could connect, get
a LAN IP assigned, and attempt to access all devices.
http://www.whoisonmywifi.com/
Then again, I only suspect you're dealing with sip scanners.

[Liptonbrisk]

Earlier I did fiddle around with the SIP option.

Not in conjunction with UPnP being disabled, you didn't.

[Degenerate]

I'll try the UPnP option as well.

Disable that.

Done

Disable all port forwarding.

Done

Turn off router. Turn off ATA.
Turn on router. Wait a few minutes. Turn on ATA.

Done

Audio works both ways, but we're still getting the calls. My wife says it hasn't happened in the past 30 minutes, but it did happen right after she turned on the ATA. One ting I haven't been able to verify is what number shows up in the ATA after a phantom call. Right now it shows my work phone number because I was the last person to call home. I've asked my wife to refresh the page when a phantom call comes in and to take note of what appears next to "Last Caller Number".

[Jake]

I don't want to jump in when others are help as I know too much advise can start getting confusing, but I would like to say 2 points.

Look in your online call logs on FPL. If you do not see the calls at there at the times you are getting them, then the calls are not coming through the normal phone system but in fact direct to your ATA (probably using your IP address as a SIP call).

I do not know the SPA2000, but I know a lot of the Linksys ATAs are very similar. If you look on your Line 1 tab (in advance view) do you see a setting called "Restrict Source IP" ? setting that to 'yes' should stop all calls sent to you that are not from an IP that you are registered to.

Again, sorry for jumping in.

[Mango]

If you look on your Line 1 tab (in advance view) do you see a setting called "Restrict Source IP"

Jake may get the prize for this one. I bet that will work.

[Liptonbrisk]

I agree. Try what Jake wrote.

DMZ, Portfowarding, and UPnP are off. Not much else left coming from WAN that makes any sense.

Look in your online call logs on FPL. If you do not see the calls at there at the times you are getting them, then the calls are not coming through the normal phone system but in fact direct to your ATA

Both cell phones and landlines can call FPL numbers on one ring and drop without the call being answered. FPL call logs will not record the event. The ATA will. I just tested again.
If the call isn't answered, FPL call logs don't list the attempted call. Consequently, FPL call logs are not terribly useful here since calls from landlines and cells aren't necessarily listed either. You can test this yourself.