Signal Definitions
Verosint uses signals to evaluate accounts for fraud based on open-source intelligence data. Account fraud can be determined through IP address, email, and phone data characteristics. Once fraud is found, signals power rules to guard against unwanted access to your systems.
Account Evaluation
Signal | Type | Description |
---|---|---|
account.asnCount.last24hours | integer | The number of distinct ASNs used to access this account in the last 24 hours |
account.asnCount.last7days | integer | The number of distinct ASNs used to access this account in the last 7 days |
account.asoCount.last24hours | integer | The number of distinct ISPs used to access this account in the last 24 hours |
account.asoCount.last7days | integer | The number of distinct ISPs used to access this account in the last 7 days |
account.connectedAccounts.count | integer | The number of other accounts connected to this account in SignalPrint |
account.eventCount.last24hours | integer | The number of events seen for this account in the last 24 hours |
account.eventCount.last7days | integer | The number of events seen for this account in the last 7 days |
account.eventCount.lastHour | integer | The number of events seen for this account in the last hour |
account.locationCount.last24hours | integer | The number of distinct locations used to access this account in the last 24 hours |
account.locationCount.last7days | integer | The number of distinct locations used to access this account in the last 7 days |
account.loginFailedCount.last24hours | integer | The number of login failed events seen for this account in the last 24 hours |
account.loginFailedCount.last7days | integer | The number of login failed events seen for this account in the last 7 days |
account.loginFailedCount.lastHour | integer | The number of login failed events seen for this account in the last hour |
account.loginSuccessCount.last24hours | integer | The number of login success events seen for this account in the last 24 hours |
account.loginSuccessCount.last7days | integer | The number of login success events seen for this account in the last 7 days |
account.loginSuccessCount.lastHour | integer | The number of events seen for this account in the last hour |
account.mfaFailedCount.last24hours | integer | The number of MFA failed events seen for this account in the last 24 hours |
account.mfaFailedCount.last7days | integer | The number of MFA failed events seen for this account in the last 7 days |
account.mfaFailedCount.lastHour | integer | The number of MFA failed events seen for this account in the last hour |
account.mfaSuccessCount.last24hours | integer | The number of MFA success events seen for this account in the last 24 hours |
account.mfaSuccessCount.last7days | integer | The number of MFA success events seen for this account in the last 7 days |
account.mfaSuccessCount.lastHour | integer | The number of MFA success events seen for this account in the last hour |
account.userAgentCount.last24hours | integer | The number of distinct user agents used to access this account in the last 24 hours |
account.userAgentCount.last7days | integer | The number of distinct user agents used to access this account in the last 7 days |
account.verificationSuccessCount. last24hours | integer | The number of verification success events seen for this account in the last 24 hours |
account.verificationSuccessCount. last7days | integer | The number of verification success events seen for this account in the last 7 days |
account.verificationSuccessCount. lastHour | integer | The number of verification success events seen for this account in the last hour |
account.verificationSuccessCount.total | integer | The total number of verification success events seen for this account in the last 180 days |
Email Address Evaluation
Signal | Type | Description |
---|---|---|
email.breachInfo.breaches | array | Array containing data about every time the email was breached |
email.breachInfo.count | integer | Determines if an email is found in any known breaches and the number of breaches |
email.breachInfo.daysSinceLastBreach | integer | Identifies the time in days since the last breach in which the email was found |
email.breachInfo.mostRecentBreachDate | string | Determines if an email is found in a breach, specified by date |
email.breachInfo.yearsSinceLastBreach | integer | Identifies the time in years since the email was found in a breach |
email.domain | string | Domain name of the email in a normalized format |
email.domainRegistrationInfo. daysSinceDomainRegistered | integer | Identifies the time in days since the email domain was registered |
email.domainRegistrationInfo. domainRegistrationDate | string | Specifies a date by which the email domain should have been registered |
email.domainRegistrationInfo. yearsSinceDomainRegistered | integer | Identifies the time in years since the email domain was registered |
email.emailServer | string | Specifies an email server name |
email.riskScore | integer | Specifies a risk value for an email between 0 (safe) and 100 (risky) for Verosint to assess against OSINT data and internal algorithms |
Event Evaluation
Signal | Type | Description |
---|---|---|
event.anomalyScore | integer | Specifies an anomaly value for the event between 0 (normal) and 100 (highly unusual) relative to the account’s history |
event.lists | array | Event is on these lists |
event.riskScore | integer | Specifies a risk value for an event between 0 (safe) and 100 (risky) for Verosint to assess against OSINT data and internal algorithms |
event.risks | array | See details in the table |
Risk Signals Associated With The Event
Value | Description |
---|---|
ACCOUNT:ACCOUNT_SHARING | Multiple users share credentials to access an account authorized for a single user |
ACCOUNT:DORMANT_ACCOUNT | This account has not been active in this workspace for 90 days |
ACCOUNT:OUTLIER_ACCOUNT | Indicates unusual activity relative to other accounts in this workspace |
ACCOUNT:TAKE_OVER | Indicates that the account has been accessed through unusual activity |
EMAIL:ALIAS | Indicates if the email address is an alias, usually due to special characters (+ or -) in the username |
EMAIL:BREACHED | Email was breached at least once in the last 2 years |
EMAIL:DISPOSABLE | Determines if an email is temporary and expires after a certain period of time |
EMAIL:FREE | Indicates if the email has been registered with a free email provider such as Gmail or Yahoo |
EMAIL:GENERIC | Indicates if the username portion of the email address is categorized as generic. For example, [email protected] |
EMAIL:INVALID | The supplied email address is invalid |
EMAIL:INVALID_A | Determines if an email’s domain has a valid IP address record |
EMAIL:INVALID_DNS | Determines if an email’s domain has valid nameserver records |
EMAIL:INVALID_DOMAIN | Determines if an email's domain is registered |
EMAIL:INVALID_ICANN_SUFFIX | Validates that an email's top-level domain is maintained by the Internet Corporation for Assigned Names and Numbers (ICANN) |
EMAIL:INVALID_MX | Validates that an email’s domain has one or more valid mail exchanger (MX) records |
EMAIL:INVALID_SPF | Validates that an email’s domain has a valid sender policy framework (SPF) record |
EMAIL:PARKED | Identifies if the email is from a parked domain |
EMAIL:RELAY | Identifies if the email is forwarded to another email address |
EMAIL:RISKY_TLD | Determines if an email is associated with a risky top-level domain |
EVENT:ANOMALOUS_EVENT | Indicates an Anomaly Score ≥ 75, signaling highly unusual activity relative to the account’s history |
EVENT:IMPOSSIBLE_TRAVEL | The speed of travel between a user's last known location and current location is not possible |
EVENT:NEW_PRINT | New prints indicate outlier activity (such as a new device) |
EVENT:STUFFING_ATTACK | Indicates that the ASN or IP address of an event is currently attempting to access multiple accounts at an unnatural speed |
EVENT:VERIFIED_PRINT | Print was used to successfully verify the identity of the account |
IP:ACTIVE_TOR | Determines if an IP address is coming from a currently active Tor node, usually to hide a true IP address |
IP:BOT | Determines if an IP address is a known bot |
IP:CRAWLER | Determines if an IP belongs to a business that scans the Internet, typically for the purpose of web indexing |
IP:DENY_LIST | Checks if the IP address is on a deny list |
IP:HOSTED | Determines if the IP address belongs to a cloud provider |
IP:INVALID | The supplied IP address is invalid |
IP:MALICIOUS | Determines if an incoming IP address can be found in a reported scam, breach, or malicious attack |
IP:NONROUTABLE | The IP address is classified as non-routable |
IP:PROXY | Determines if an IP address is coming from a proxy server, both HTTP and non-HTTP (such as SOCKS) proxies |
IP:RELAY | Private relay service IP address (such as Apple relay, Cloudflare, or Akamai) |
IP:TOR | Identifies if an IP address is coming from a known Tor exit node |
IP:VPN | Identifies if an IP address is coming from a known VPN |
PAYMENT_HASH:SHARED_PAYMENT_METHOD | Payment Hash was linked to multiple accounts |
PHONE:DISPOSABLE | Determines if a phone number is temporary and expires after a certain period of time |
PHONE:DO_NOT_ORIGINATE | Determines if an account's phone number is on the Do Not Originate (DNO) registry, which lists numbers used only for inbound calls |
PHONE:INVALID | The supplied phone number is invalid |
PHONE:NOT_REACHABLE | Determines if a phone number is in service or out of service |
PHONE:PORTED | Determines if a phone number has been ported |
PHONE:WIRELESS | Determines the phone number type (mobile and prepaid phone numbers will have a value of True, voice-over-IP and traditional landlines will have a value of False) |
PRINT:MULTIPLE_ACCOUNTS | Print was linked to multiple accounts for fraudulent purposes (such as promotions abuse or a banned user) |
USERAGENT:BOT | Identifies if the user agent is a known bot |
Request Identifiers
Signal | Type | Description |
---|---|---|
identifiers.accountId | string | The account ID |
identifiers.deviceId | string | The device ID |
identifiers.email | string | The email address |
identifiers.ip | string | The IPv4 or IPv6 address |
identifiers.paymentHash | string | The hashed payment method identifier |
identifiers.phone | string | The phone number in E.164 format |
identifiers.printId | string | The print ID |
identifiers.timestamp | string | The RFC3339 formatted timestamp. Current time is used if not specified |
identifiers.userAgent | string | The full user agent string |
IP Address Evaluation
Signal | Type | Description |
---|---|---|
ip.asn | string | Identifies the Autonomous System Number of the IP assigned to a group of IP prefixes run by network operators that maintain a defined routing policy to the Internet |
ip.asnInfo.size | string | Size class expressed in t-shirt sizes that reflect the available IP addresses in the ASN |
ip.aso | string | Identifies the Autonomous System Organization that administers the IP address |
ip.geo.latitude | number | Identifies the location coordinate of the IP address north or south of the equator |
ip.geo.longitude | number | Identifies the location coordinate of the IP address east or west of the prime meridian |
ip.location.city | string | Identifies the city in which the IP address is located |
ip.location.continent | string | Identifies the two-letter continent code (ISO 3166-1) from which an IP address is located |
ip.location.country | string | Identifies the two-letter country code (ISO 3166-1) from which an IP address is located |
ip.location.region | string | Identifies the geographical region (state/province) in which the IP is located |
ip.location.regionCode | string | Identifies the two-letter region code from which an IP address is located |
ip.locationId | string | Unique identifier assigned to the location by GeoNames |
ip.network.cidr | string | Network address in the CIDR (Classless Inter-Domain Routing) format |
ip.network.size | string | Size class expressed in t-shirt sizes that reflect the available IP addresses in the network |
ip.privacyProvider | string | Name of the IP privacy service provider, available when vpn, relay, hosted or proxy is true |
ip.riskScore | integer | Specifies a risk value for an IP address between 0 (safe) and 100 (risky) for Verosint to assess against OSINT data and internal algorithms |
ip.signupSuccessCount.last24hours | integer | The number of signup success events seen for this IP in the last 24 hours |
ip.signupSuccessCount.last7days | integer | The number of signup success events seen for this IP in the last 7 days |
ip.signupSuccessCount.lastHour | integer | The number of signup success events seen for this IP in the last hour |
ip.timezone | string | Identifies the timezone of an IP address |
ip.type | string | The type of business using the IP address such as isp, hosting, education |
Phone Number Evaluation
Signal | Type | Description |
---|---|---|
phone.carrier | string | Specifies the name of a phone service provider |
phone.carrierIdentificationCode | string | Specifies the carrier identification code (CIC), a four-digit numeric code assigned to carriers or other entities that access a local exchange carrier (LEC) network |
phone.location.country | string | Specifies the two-letter country code (ISO 3166-1) where the phone number is registered |
phone.mobileCountryCode | string | Specifies a mobile country code (MCC) |
phone.mobileNetworkCode | string | Specifies a mobile network code (MNC) |
phone.riskScore | integer | Specifies a risk value for a phone number between 0 (safe) and 100 (risky) for Verosint to assess against OSINT data and internal algorithms |
phone.type | string | Identifies the specified phone number type such as wireless, a fixed line, or Voice Over IP |
SignalPrint Evaluation
Signal | Type | Description |
---|---|---|
print.connectedAccounts.count | integer | The number of other accounts connected to this print in SignalPrint |
print.eventCount.last24hours | integer | The number of events seen for this print in the last 24 hours |
print.eventCount.last7days | integer | The number of events seen for this print in the last 7 days |
print.eventCount.lastHour | integer | The number of events seen for this print in the last hour |
print.failedAcctsCount.last24hours | integer | The number of accounts with a a failed login connected to this print in the last 24 hours |
print.failedAcctsCount.last7days | integer | The number of accounts with a a failed login connected to this print in the last 7 days |
print.failedAcctsCount.lastHour | integer | The number of accounts with a a failed login connected to this print in the last hour |
print.identificationMethod | string | Specifies the method used to calculate the print ID. Possible values are PROVIDED (the ID is provided with the event) and PRINT (Verosint generates the ID) |
print.loginFailedCount.last24hours | integer | The number of login failed events seen for this print in the last 24 hours |
print.loginFailedCount.last7days | integer | The number of login failed events seen for this print in the last 7 days |
print.loginFailedCount.lastHour | integer | The number of login failed events seen for this print in the last hour |
print.loginSuccessCount.last24hours | integer | The number of login success events seen for this print in the last 24 hours |
print.loginSuccessCount.last7days | integer | The number of login success events seen for this print in the last 7 days |
print.loginSuccessCount.lastHour | integer | The number of events seen for this print in the last hour |
print.mfaFailedCount.last24hours | integer | The number of MFA failed events seen for this print in the last 24 hours |
print.mfaFailedCount.last7days | integer | The number of MFA failed events seen for this print in the last 7 days |
print.mfaFailedCount.lastHour | integer | The number of MFA failed events seen for this print in the last hour |
print.mfaSuccessCount.last24hours | integer | The number of MFA success events seen for this print in the last 24 hours |
print.mfaSuccessCount.last7days | integer | The number of MFA success events seen for this print in the last 7 days |
print.mfaSuccessCount.lastHour | integer | The number of MFA success events seen for this print in the last hour |
print.signupFailedCount.last24hours | integer | The number of signup failed events seen for this print in the last 24 hours |
print.signupFailedCount.last7days | integer | The number of signup failed events seen for this print in the last 7 days |
print.signupFailedCount.lastHour | integer | The number of signup failed events seen for this print in the last hour |
print.signupSuccessCount.last24hours | integer | The number of signup success events seen for this print in the last 24 hours |
print.signupSuccessCount.last7days | integer | The number of signup success events seen for this print in the last 7 days |
print.signupSuccessCount.lastHour | integer | The number of signup success events seen for this print in the last hour |
print.verificationSuccessCount. last24hours | integer | The number of verification success events seen for this print in the last 24 hours |
print.verificationSuccessCount. last7days | integer | The number of verification success events seen for this print in the last 7 days |
print.verificationSuccessCount.lastHour | integer | The number of verification success events seen for this print in the last hour |
print.verificationSuccessCount.total | integer | The total number of verification success events seen for this print in the last 180 days |
User Agent Evaluation
Signal | Type | Description |
---|---|---|
userAgent.browser.name | string | Identifies the name of the browser, such as Safari |
userAgent.browser.version | string | Identifies the version of the browser |
userAgent.device.name | string | Identifies the name of the device |
userAgent.device.type | string | Identifies the type of device |
userAgent.os.name | string | Identifies the operating system on the device |
userAgent.os.version | string | Identifies the version of the operating system on the device |
Updated 1 day ago