CountryGrouping

This guide covers country-based features in VoIPmonitor: GeoIP for IP geolocation, phone number prefix detection, anti-fraud alerts, and geographic filtering.

Country Detection Methods

VoIPmonitor uses two distinct methods for country detection:

Method	Based On	Use Case	Configuration
GeoIP	IP address geolocation	Detect location of endpoints	Settings → System Configuration → GeoIP
Country Prefixes	Phone number prefix (+1, +44, etc.)	Detect call destinations	Settings → Country Prefixes

ℹ️ Note: GeoIP tells you WHERE a device is located. Country Prefixes tell you WHERE a call is going to (destination number).

GeoIP Configuration

GeoIP services are configured in Settings → System Configuration → GeoIP.

Service Priority

VoIPmonitor tries services in order until successful:

1. MaxMind API — Commercial, highest accuracy (requires API key)
2. IPInfoDB API — Alternative service (requires API key)
3. Local database — Bundled with GUI, updated each release
4. Free portals — Fallback (ipinfodb, freegeoip, maxmind)

💡 Tip: For the most accurate and up-to-date data, configure a MaxMind API key. API lookups use MaxMind's live database.

For database update procedures, see Order_of_GeoIP_processing.

Country Prefix Configuration

Country prefixes are used for destination country alerts based on called numbers (not IPs).

Configuration: Settings → Country Prefixes

Setting	Description
Prefix list	Phone number prefixes per country (+1 for US, +44 for UK, etc.)
NANPA support	North American Numbering Plan handling
Strict for prefixes	Require exact prefix match

Country-Based Anti-Fraud Alerts

Configure in Alerts → Anti Fraud. For complete anti-fraud documentation, see Anti-fraud.

Alert Types

Alert	Detection Method	Trigger	Use Case
Country/Continent Destination	Phone prefix	Calls to specific countries/continents	Block high-fraud destinations
Change CDR Country	GeoIP	Caller/callee IP country changes	Detect compromised accounts
Change REGISTER Country	GeoIP	Device registers from different country	Detect SIP credential theft

Country Destination Alert Configuration

• Countries/Continents: Select targets (or "ALL")
• Exclude countries: Whitelist for legitimate destinations
• Strict for prefixes: Require exact prefix match
• Threshold: Number of calls or percentage to trigger

⚠️ Warning: Country Destination Alert uses PHONE NUMBER PREFIXES, not GeoIP. To detect calls based on destination IP country, use CDR filters with GeoIP.

Change Country Alerts Configuration

Both "Change CDR Country" and "Change REGISTER Country" alerts detect geographic anomalies:

• Exclude countries: Whitelist for expected travel (e.g., border regions)
• Filter by number/IP: Apply only to specific users or ranges
• Time window: How far back to check for previous location

Country Filtering in CDR

When GeoIP is enabled:

1. Go to CDR → Filter
2. Use country filter fields (Caller Country, Called Country)
3. Select countries from dropdown or enter country codes

Applications:

• Traffic analysis by geographic region
• Compliance reporting
• International call pattern monitoring

Integration with IP Groups

Combine GeoIP features with IP Groups for granular control:

• Create IP Groups for known provider IPs per country
• Use Groups in alert filters for precise targeting
• Combine country alerts with IP-based filtering

Troubleshooting

GeoIP Data Not Showing

1. Verify GeoIP configuration in System Configuration
2. Check network connectivity to voipmonitor.org
3. Try manual database update (see manual import)

Incorrect Country Detection

ℹ️ Note: GeoIP accuracy depends on IP allocation databases which may be outdated for some ranges.

To correct GeoIP data:

1. Submit correction to MaxMind Correction Form
2. Wait for MaxMind database update cycle
3. Contact VoIPmonitor support to include updated data in next GUI release
4. Upgrade GUI to receive corrected database

Faster alternative: Configure MaxMind API key for real-time lookups.

See Also

• Anti-fraud — Complete anti-fraud alert configuration
• Order_of_GeoIP_processing — GeoIP service priority and manual database updates
• Groups — IP Groups and Telephone Number Groups
• Alerts — General alert configuration

AI Summary for RAG

Summary: VoIPmonitor uses two country detection methods: GeoIP (IP address geolocation) for detecting WHERE devices are located, and Country Prefixes (phone number prefixes like +1, +44) for detecting WHERE calls are going. GeoIP services follow priority: MaxMind API → IPInfoDB API → local database → free portals. Anti-fraud alerts include Country/Continent Destination (prefix-based, real-time), Change CDR Country (GeoIP, detects caller IP country changes), and Change REGISTER Country (GeoIP, detects registration from different country). Country Destination Alert uses PHONE PREFIXES not GeoIP. CDR filtering supports country-based queries when GeoIP is enabled.

Keywords: country grouping, GeoIP, MaxMind, IPInfoDB, country prefixes, country filtering, anti-fraud, country destination alert, change CDR country, change REGISTER country, geographic location, IP geolocation, fraud detection, country whitelist, exclude countries, continent alert, phone prefix, NANPA, international prefix

Key Questions:

• What is the difference between GeoIP and Country Prefixes in VoIPmonitor?
• How do I filter CDR by country?
• How do I set up country-based anti-fraud alerts?
• What is the Change CDR Country alert?
• How do I detect when a device registers from a different country?
• How do I whitelist countries in anti-fraud alerts?
• What GeoIP services does VoIPmonitor use?
• How do I configure country destination alerts?
• Does Country Destination Alert use GeoIP or phone prefixes?
• How do I fix incorrect country detection?