I have several IP7000 IP phones in our company but one of them has recently been showing up in our IDS system attempting to connect to a Tor exit node on ntp port 123 at IP 158.69.35.227. The IP address has a DNS name of tor-exit.ubermen.net.
Our IDS is blocking the connection but, of course, it concerns me.
I have checked the configuration of the phone but find no reference to that IP address. I also updated it to the latest firmware
Short of resetting it to factory defaults or even replacing it, are there any suggestions?