Emergency Procedure — Compromised Account
Signs of compromise
- Abnormal credit consumption
- Calls to unknown destinations in the CDRs
- Password change email that you did not initiate
- Logins from unknown IPs
Immediate actions
- Change your password immediately
- Revoke all SIP credentials: Client Area → Services → Regenerate Keys
- Contact WebTic support urgently: Telegram @LOCALHOST2012 or +41 91 204 18 49
- Enable 2FA if you have not already done so
- Review the CDRs for the last 48 hours
WebTic can
- Temporarily suspend outbound calls during the investigation
- Block suspicious IPs on the infrastructure
- Provide a full activity report for your insurer if necessary
