A focused reference on the SIP headers that determine whether a call is trusted, attested, or blocked at the network edge.
The SIP request that starts a call. The Request-URI identifies the called party; body contains SDP for media negotiation.
The logical originator of the call. Trivially spoofable on IP networks — do not use for trust decisions on its own.
The network-asserted identity of the caller, set by a trusted proxy. Widely used inside carrier networks for billing and lawful intercept.
The STIR/SHAKEN signed header. Contains the JWT that cryptographically binds the calling number to the originating carrier's attestation.
Records call forwarding and redirection history. Used by terminating carriers to reconstruct call paths and detect loops or laundering.
The direct SIP URI to reach the endpoint. Fraud tooling inspects this for suspicious IP ranges and unregistered endpoints.
Identifies the softswitch or endpoint. Not a security signal, but useful for fingerprinting known-bad autodialers.
SipShield inspects every SIP INVITE in real time — cross-checking From, PAI, and Identity headers against KYC records, STIR/SHAKEN attestation, and behavioral models to decide whether the call is signed, downgraded, or blocked.
See How It Works