If a sip phone is connected to lan port  the firewall open a "udp redirect port 5060 IN from anybody"

Our sip local phone only open a udp 5060 connection to to  91.194.96.33 (not to every body)

This 45.155.91.157 try to abuse our local ip phone

18:50:11.585099 IP 91.194.96.33.5060 > 46.227.18.241.5060: SIP: OPTIONS sip:33987877075@192.168.1.105:5060 SIP/2.0
18:50:11.618912 IP 46.227.18.241.5060 > 91.194.96.33.5060: SIP: SIP/2.0 200 OK
18:50:21.584825 IP 91.194.96.33.5060 > 46.227.18.241.5060: SIP: OPTIONS sip:33987877075@192.168.1.105:5060 SIP/2.0
18:50:21.596371 IP 46.227.18.241.5060 > 91.194.96.33.5060: SIP: SIP/2.0 200 OK
18:50:22.466869 IP 46.227.18.241.5060 > 91.194.96.33.5060: SIP
18:50:32.972293 IP 45.155.91.157.59360 > 46.227.18.241.5060: SIP: INVITE sip:00083420539002889@46.227.18.241 SIP/2.0
18:50:32.981354 IP 46.227.18.241.5060 > 45.155.91.157.59360: SIP: SIP/2.0 100 Trying
18:50:33.031606 IP 46.227.18.241.5060 > 45.155.91.157.59360: SIP: SIP/2.0 180 Ringing
18:50:52.465265 IP 46.227.18.241.5060 > 91.194.96.33.5060: SIP..
 

There is no upnp, no dmz no redirect with the local ip phone  (192.168.1.105) firewall SPI is ok  (if not it's the Same)

sip ALG/ IOt isolation   On or  off, the same...