Answer an ITG traceback from your own CDRs

This is written for carriers who send calls to the United States.

A traceback on that traffic names a date, a time, a calling number, and a dialed number. You have 24 hours to find the call on M4 SBC or on MOR, name the customer and the trunk it came in on, and stop further calls from that trunk.

The 24 hours

On 27 August 2026 the FCC Enforcement Bureau told nine providers to cure Robocall Mitigation Database (RMD) certifications after those nine left 51 traceback requests unanswered. TCPA.com reported the order (DA 26-873) on 25 October 2026. The certification includes a commitment to answer traceback requests from the FCC, law enforcement, and the ITG in 24 hours. If the Bureau removes a certification, other providers have to stop accepting that company’s calls, except calls to 911.

October added three more orders:

• On 5 October 2026 the Bureau removed Digital Solutions from the RMD. The ITG traced the calls. The company said it originated them and named three customers. The company then failed to give the Bureau an adequate reply. The 5 October removal order tells other providers to stop accepting Digital Solutions traffic within two business days.
• On 8 October 2026 the Bureau issued an initial determination against Aspireistic. That order is not a removal. The company’s reply was 12 days late, and it did not fix the four gaps in the RMD certification.
• On 16 October 2026 the Bureau removed Mexico IP Phone. TCPA.com’s account of that order gives the grounds as a forged numbering filing and an undisclosed investigation.

In April 2026 the FCC proposed a $4.5 million penalty against gateway provider Voxbeam. Voxbeam had accepted 60,873 calls from Axfone, a foreign provider that was not listed in the RMD. Axfone had been a customer since 2012 and had placed no calls from 17 November 2018 until 31 March 2025. The Commission started from $5,625,000, on 2,250 verified calls, and the proposed penalty is 20% lower because Voxbeam blocked that traffic in the 24 hours after the first of four ITG requests.

A proposed RMD rule, published 9 September 2026, set comments for 9 October 2026 and reply comments for 9 November 2026. The dates are on the Federal Register PDF.

This is not legal advice. Talk to your counsel before you answer the portal or change an RMD filing.

Find the call

Use the four fields on the request. This example is not a real traceback: 20 October 2026, 14:03, calling number 18005550100, dialed number 12025550199.

Open REPORTS → Calls List. Set the time around 14:03 in the zone your screen uses. Type the calling number in Source. Type the dialed number in Destination.

Destination accepts a pattern:

• 12025550199 returns that number.
• 1202555% returns numbers that begin with 1202555.
• %0199 returns numbers that contain 0199.
• 1202555019_ returns that prefix plus one more character.

% stands for any run of characters. _ stands for one character. The same patterns work on Source.

Source stores the calling number as it arrived. If the switch replaces that number from a number pool before the call goes to the terminator, it stores the sent value in Source (CallerID) sent to TP. A Source search misses the row. Go to MAINTENANCE → Settings → Calls List and enable Show CallerID sent to TP. The search field appears under Source. Search it with the same patterns.

You can also search by Originator (the user), Origination Point, Termination Point, or UniqueID. Export to CSV writes out the calls on the screen. Export to PDF writes those same calls.

Open the call-info icon on the row.

Call Info shows PAI Number, then Diversion Number, then LegA Call-ID. Diversion Number is the SIP Diversion header stored with the call. It stays empty when the call had no Diversion header.

Call Tracing is a different tool. From REPORTS → Calls List, or from the Origination Point, it places a new test call and does not ring terminators. A second run can come out different. For the call in the request, open Call Log on that Call Info page.

On MOR, open Last Calls for that user and that hour, then open Call Info. The same three fields are there. MOR deletes the Asterisk Call Log after 14 days. The CDR row is the record you can still keep.

Name the upstream

The Calls List row names the Originator and the Origination Point. The Originator is the user, the customer account. The Origination Point is the trunk the call came in on. Those two names are the upstream you put in the reply.

Export to CSV while the filter still shows that hour and that calling number. The file is the set of rows you hand to the person who writes the ITG reply. The switch does not send the reply.

The 8 October Aspireistic order says the company’s ITG replies named the end customer and did not name an upstream provider on ten requests. The Originator and the Origination Point are those two names.

Stop the trunk

1. Open the Origination Point. Set Active to no. M4 refuses new calls from that trunk.
2. To refuse one calling number and leave the trunk up, put that number in Source (CallerID) Deny. The field is a regular expression. Source (CallerID) Allow takes .* when you want every other CLI to pass.
3. On MOR, go to SETTINGS → Users → Devices → CLIs and ban the CLI with the red cross. With no IVR selected, MOR ends the call with congestion.

If the export shows several Origination Points for the same user, set Active to no on each of them. An alert can disable the client, and that covers every trunk on the account.

See the spike first

The Voxbeam notice is a quiet account that woke up. Axfone placed no calls from 17 November 2018 until 31 March 2025, then 60,873 calls from 31 March to 2 April 2025. M4 has no dormant-account flag. Use a TOTAL CALLS alert on that client.

Open SECURITY → Alerts.

• Primary object: one client, or one Origination Point.
• Parameter: TOTAL CALLS.
• Check last: the span you set, such as 1 hour.
• Alert if >= a count above what that customer sends in that span.
• Disable Primary Object: on. That disables the client or the Origination Point when the alert fires. It is not available when the object is a destination.
• Notify by email: on. For a client, the mail goes to the NOC address, then Main, then Billing, then Rates. M4 sends no mail if none of those addresses is set.

SIMULTANEOUS CALLS and PRICE SUM apply to users and providers. Put those on the client. PRICE SUM is the spend alert. Prepaid cut-off and a cap on a customer whose login is valid are in Your Firewall Passed. Your Balance Didn’t.

On an Origination Point alert you can also set a routing group, or deactivate a dial peer. Disable Primary Object is the action that stops the object.

CPS is separate from the alert. On the Origination Point, Advanced, set Limit up to X calls, during Y seconds. You pick X and Y from the pace you accept from that trunk. When the trunk crosses the limit, the CDR shows hangup cause 304 (Originator’s CPS Limit reached) and disconnect code 826 (OP CPS limit reached). On MOR the same limit sits on the device (hangup cause 244) and on the provider (hangup cause 243).

Keep the record

On each Origination Point that sends US-bound traffic, turn on Add STIR/SHAKEN Identity. Set the attestation level to By TP, A, B, C, or Default. Default uses the level in the server configuration. If the Origination Point and the Termination Point both sign, the Origination Point level wins, unless you chose By TP. M4 builds the SIP Identity header on Kamailio 5.7 or later. The private key and the public certificate come from a STIR/SHAKEN authority. Kolmisoft does not supply them. This step signs calls you send. It does not check signatures on calls you receive, and it does not score the traffic. The MOR path, including what A, B, and C stand for, is STIR/SHAKEN with MOR. MOR signing needs X19, and it runs on PJSIP devices and providers.

On MOR, open SETTINGS → Setup → Settings → Calls. Archive Calls older than defaults to 365 days. Set the number to 0 and archiving stays off. Delete Calls instead of Archiving removes the old rows. Archive only ANSWERED calls deletes failed, busy, and no-answer calls, so leave that box off if a traceback might name a call that did not connect. Storage is the MySQL table mor.calls_old, a TGZ of CSV files (50,000 lines per file), or that TGZ sent to FTP. Read the rows at STATISTICS → Calls → Archived Calls. The files list is on that page, and admins can open it.

On M4, open MAINTENANCE → Settings → Archived Calls. The choices match MOR: another table, a TGZ, or FTP. The M4 settings page does not print a default number of days. Read the value on your system before you assume a call from last year is still on Calls List. Archived rows are at Reports → Call list → Archived Calls. TGZ files are at REPORTS → Call list → Archived Calls → Files.

M4 also removes stored CDR export files after a number of days. The default is 30, and the minimum is 7. That timer covers the export folder, not the calls table. Copy a traceback CSV off the server if you still need it after that window.

FAQ

Does signing on the switch check the caller?

Signing builds the SIP Identity header on the way out. You bring the certificate. The switch does not verify another carrier’s signature in this feature, and it does not produce a robocall score.

Source search returns nothing. What do I search next?

Enable Show CallerID sent to TP, then search Source (CallerID) sent to TP. Match the request’s clock to the time on Calls List. A % pattern on Destination catches a dialed number that arrived with an extra prefix.

Can the switch file the ITG reply?

No. Export the CSV. A person sends the reply. There is no ITG submission on the switch.

On the next request

Copy the time, the calling number, and the dialed number. Search Source and Destination on Calls List, open Call Info, and export the user and the Origination Point. Set Active to no on that trunk. Add a TOTAL CALLS alert on that customer with Disable Primary Object, and read the archive day-count so the row is still there next month.

To click the same screens on a Kolmisoft system, open the M4 online demo. It is the web interface. It does not place calls.