In the Forwarded Called Numbers and Countries pages, you can whitelist or blacklist forwarded calls by called numbers or destination countries.
Call forwarding fraud can occur when a subscriber has the capability to enable international call forwarding on their line by configuring their settings within a CommPortal. If a hacker can successfully obtain the password for the subscriber’s CommPortal account, then they can enable call forwarding to a high cost international number. The hacker will make a large volume of calls to the subscriber’s line, which will then be forwarded to the international number. ClearIP’s forwarded call blacklists can protect against this vulnerability if your subscribers have the capability to enable international call forwarding but do not typically forward calls to international destinations.
Forwarded calls are still monitored by ClearIP’s general Whitelist/Blacklist pages such as the Whitelist/Blacklist Called Countries page. The forwarded blacklists are an optional tool that can be used if the blacklisting rules should be more restrictive for forwarded calls than the blacklisting rules for general calls. If no forwarded blacklist rules are created, then ClearIP applies the general blacklist rules for all non-forwarded and forwarded calls.
Diversion Header
ClearIP determines if a call has been forwarded by seeing whether there is a Diversion header in the SIP Invite. These features can be useful for preventing calls from being forwarded to international or high-cost destinations.
Here is an example SIP Invite with a Diversion header.
INVITE sip:+14049313777@outbound.sip.clearip.com:5060;transport=tcp SIP/2.0
Via: SIP/2.0/TCP 1.1.1.1:5060;branch=z9hG4bK+6bbdf6a159bf7dfd6b73b01918293b8c1+sip+1+ba267b04
From: <sip:+14045937200@1.1.1.1:5060>;tag=1.1.1.1+1+7df2100e+2cb7ce34
To: <sip:+14049313777@outbound.sip.clearip.com>
CSeq: 490064208 INVITE
Expires: 180
Content-Length: 134
Supported: resource-priority,siprec, 100rel
Contact: <sip:832ed61279559274aa6f0a815c4060f4@1.1.1.1:5060>;isup-oli=00
Content-Type: application/sdp
Allow-Events: message-summary, refer, dialog, line-seize, presence, call-info, as-feature-event, calling-name, ua-profile
Call-ID: 0gQAAC8WAAACBAAALxYAABDqS1l0bVz/Gz84S1QNuRD45ViI/PrRw43zWd+jua2n@1.1.1.1
Organization: Metaswitch Networks
Allow: INVITE, ACK, CANCEL, BYE, REGISTER, OPTIONS, PRACK, UPDATE, SUBSCRIBE, NOTIFY, REFER, INFO, PUBLISH
Referred-By: <sip:+14045266060@10.50.65.10:5060>
Max-Forwards: 68
Diversion: <sip:+14045266060@10.50.65.10:5060>;reason=unconditional
P-Asserted-Identity: <sip:+14045937200@10.50.65.10:5060>
v=0
o=- 84825652478502 84825652478502 IN IP4 1.1.1.1
s=-
c=IN IP4 1.1.1.1
t=0 0
m=audio 25142 RTP/AVP 0
a=ptime:20
For forwarded calls, ClearIP treats the phone number in the Diversion header as the Translated Calling Number. In the example, a call is originally made from 404-593-7200 into the subscriber’s number 404-526-6060. The subscriber has enabled external call forwarding to number 404-931-3777. ClearIP sees the outbound call leg where the call is forwarded from 404-526-6060 to 404-931-3777. The number 404-526-6060 in the Diversion header is used to populate the Translated Calling Number field which is used for blacklisting and fraud trigger rules. The original calling number 404-593-7200 in the P-Asserted-Identity and From header is used to populate the Asserted Calling Number field.
If the call contains a Diversion header in the SIP Invite, then in the SIP Messages page, ClearIP will set the Forwarded field to Yes. Otherwise, this field will be set to No. This column must be manually selected with the Columns menu. It is not displayed by default. 
Example Forwarded Blacklist
Block Call Forwarding to International Countries. ClearIP can prevent fraud attacks where calls are forwarded to various international countries.
In this example, all calls received by ClearIP that have a diversion header pointing to a country that is not the US or Canada are immediately blocked.
Build SIP Reports to check which countries your customers forward calls to
Before you create country level forwarded blacklists for your subscribers, you can check the SIP Reports to review which countries your customers have forwarded calls to. Then you can compare your called countries list with the complete list of countries recognized by ClearIP to build a Called Country forwarded blacklist.
If you go to the SIP Reports page under the Analytics menu, the default report will display how many calls have been sent to different countries in the past hour. You should modify the SIP Report by selecting a longer date range (up to 1 year) and adding a filter Fowarded Equals Yes.
This SIP Report can be used to check whether your customers send forwarded calls to international destinations. If they do forward many calls internationally, then you may not want to implement restrictive blacklists on forwarded calls.
If your customers do not typically make forwarded calls to international destinations, then you have the option to implement forwarded blacklists.