CountryGrouping

This guide covers country-based grouping and GeoIP features in VoIPmonitor, including country filtering, anti-fraud alerts based on geographic location, and country-based CDR analysis.

Overview

VoIPmonitor uses GeoIP databases to determine the geographic location of IP addresses. This enables:

• Country-based filtering in CDR views
• Anti-fraud alerts for destination countries/continents
• Detection of country changes for registered devices
• Geographic analysis and reporting

GeoIP Configuration

GeoIP services are configured in GUI Settings → System Configuration → GeoIP.

Service Priority

VoIPmonitor uses GeoIP services in the following order:

1. MaxMind API (if API key is configured)
2. IPInfoDB API (if API key is configured and MaxMind not available)
3. Local database (updated with each GUI release)
4. Free demo portals (fallback: ipinfodb, freegeoip, maxmind)

For detailed GeoIP configuration, see Order_of_GeoIP_processing.

Country-Based Anti-Fraud Alerts

VoIPmonitor provides several anti-fraud alerts that use country detection. These are configured in GUI → Alerts → Anti Fraud.

Country/Continent Destination Alert (Realtime)

Triggers when calls are made to specific countries or continents.

Use cases:

• Block or alert on calls to high-fraud destinations
• Monitor international call patterns
• Enforce geographic calling restrictions

Configuration:

• Select target countries or continents
• Set threshold (number of calls or percentage)
• Configure notification (email, script)

Change CDR Country Alert (CDR-based)

Detects when the IP address of a caller or callee changes to a different country between calls.

Use cases:

• Detect compromised accounts being used from different locations
• Identify VPN/proxy usage
• Monitor for credential theft

Configuration:

• Exclude countries: Whitelist of allowed countries (e.g., if users legitimately travel between certain countries)
• Filter by specific numbers or IP ranges

Change REGISTER Country Alert (CDR-based)

Detects when a device's registration IP address changes to a different country.

Use cases:

• Detect SIP account takeover
• Monitor device mobility
• Identify suspicious registration patterns

Country Filtering in CDR

When GeoIP is enabled, you can filter CDR records by country in the GUI:

1. Go to CDR → Filter
2. Use the country filter fields in the filter form
3. Select specific countries from the dropdown

This allows you to:

• View all calls to/from a specific country
• Analyze traffic patterns by geographic region
• Generate country-specific reports

Integration with IP Groups

For more granular control, combine GeoIP features with IP Groups:

• Create IP Groups for known provider IPs per country
• Use Groups in alert filters for precise targeting
• Combine country-based alerts with IP-based filtering

Troubleshooting

GeoIP Data Not Showing

• Check GeoIP configuration in System Configuration
• Verify GUI can reach voipmonitor.org for database updates
• See manual GeoIP database update

Reporting Incorrect GeoIP Data

ℹ️ Note: GeoIP databases are not 100% accurate. Detection is based on IP address allocation data which may be outdated or incorrect for some ranges.

If you encounter incorrect country detection for specific IP addresses:

1. Submit correction to MaxMind: Use the MaxMind Correction Form to report incorrect IP location data 2. Wait for MaxMind update: MaxMind typically processes corrections within their database update cycle 3. Notify VoIPmonitor support: Once MaxMind has updated their database, contact VoIPmonitor support to request a new GUI release that includes the updated MaxMind data 4. Upgrade GUI: Install the new GUI version to receive the corrected GeoIP database

💡 Tip: For the most accurate and up-to-date GeoIP data, configure a MaxMind API key in Settings → System Configuration → GeoIP. API-based lookups use MaxMind's live database and avoid the need to wait for GUI updates.

See Also

• Anti-fraud - Complete anti-fraud alert configuration
• Order_of_GeoIP_processing - GeoIP service priority and manual updates
• Groups - IP Groups and Telephone Number Groups
• Alerts - General alert configuration

AI Summary for RAG

Summary: Guide to country grouping and GeoIP-based features in VoIPmonitor. Covers GeoIP service configuration (MaxMind API → IPInfoDB API → local database → free portals fallback), country-based anti-fraud alerts (Country/Continent Destination for real-time detection of calls to high-fraud destinations, Change CDR Country for detecting caller IP country changes between calls, Change REGISTER Country for detecting device registration from different countries), country filtering in CDR views, and integration with IP Groups. GeoIP enables geographic analysis, fraud detection, and compliance with calling restrictions.

Keywords: country grouping, GeoIP, MaxMind, IPInfoDB, country filtering, anti-fraud, country destination alert, change CDR country, change REGISTER country, geographic location, IP geolocation, fraud detection, country whitelist, exclude countries, continent alert

Key Questions:

• How do I filter CDR by country in VoIPmonitor?
• How do I set up country-based anti-fraud alerts?
• What is the Change CDR Country alert?
• How do I detect when a device registers from a different country?
• How do I whitelist countries in anti-fraud alerts?
• What GeoIP services does VoIPmonitor use?
• How do I configure country destination alerts?
• Can I combine country alerts with IP Groups?
• How do I troubleshoot incorrect country detection?
• What is the GeoIP service priority order?