Thank you for your reply.
Unfortunately TCP not an option. I will try changing port but most likely they are just looking for any opened ones (it is really random in time so specific attack excluded at this point, I guess just port scan and then regular bots for VoIp).
Global Call / GC IP not giving any info during error. that trace is the only "active" ones I saw.
I can't track exact moment of an issue because no signal or error coming to the app (I guess happens just in between waitcall and accept), and then log being overwritten in no time (1K+ messages per second lol).
I had an idea to reject call somehow after waitcall before doing any accept. but was not able to find any good way. Is there any?