Call setup for VoIP — registering a phone, ringing, answering, transferring and hanging up. The audio itself does not travel here; it flows separately over RTP on a range of high UDP ports, which is why VoIP is notoriously awkward through NAT.
Exposed SIP is scanned relentlessly for weak extension passwords, and a compromised PBX gets used for toll fraud that can run up enormous bills in a single weekend.
An exposed PBX is scanned continuously for weak extension passwords. Check for unfamiliar registrations and review recent call charges, because toll fraud accumulates very quickly once someone is in.
The port scanner will tell you whether 5060 is reachable on a host you control. Checking from outside your own network matters: a port can be open on the machine and still be blocked at the firewall, and it is the view from the internet that decides whether anyone else can reach it.
Only scan hosts you own or have permission to test.