Block SIP REGISTER from selected countries. Config saved here; SIP middleware integration pending (the registrar.js layer needs to consult this policy — short follow-up).
Common attacker countries: RO (Romania), RU (Russia), CN (China), KP (North Korea), IR (Iran). Be careful with "allow only" — if you list US, your phones must come from US IPs only.