A method, apparatus and computer program product for performing dynamic Voice Over Internet Protocol (VOIP) endpoint mapping is presented. At least one on net endpoint of a VOIP call is determined. An endpoint data structure is used to store, for each on net endpoint of the call, a key and at least one of an Internet Protocol (IP) address of the end point, a phone number associated with the endpoint, and/or a display name associated with the endpoint. The endpoint data structure is used to correlate call legs across a network. Heuristics of the VOIP call are determined, the heuristics including information relating to the main source call leg and the main destination call leg.