Verosint uses signals to evaluate accounts for fraud based on open-source intelligence data. Account fraud can be determined through IP address, email, and phone data characteristics. Once fraud is found, signals power rules to guard against unwanted access to your systems.

Account Evaluation

Signal	Type	Description
account.asnCount.last24hours	integer	The number of distinct ASNs used to access this account in the last 24 hours
account.asnCount.last7days	integer	The number of distinct ASNs used to access this account in the last 7 days
account.asoCount.last24hours	integer	The number of distinct ISPs used to access this account in the last 24 hours
account.asoCount.last7days	integer	The number of distinct ISPs used to access this account in the last 7 days
account.connectedAccounts.count	integer	The number of other accounts connected to this account in SignalPrint
account.daysSinceFirstSeen	number	Days since Verosint first saw this Account ID
account.eventCount.last24hours	integer	The number of events seen for this account in the last 24 hours
account.eventCount.last7days	integer	The number of events seen for this account in the last 7 days
account.eventCount.lastHour	integer	The number of events seen for this account in the last hour
account.locationCount.last24hours	integer	The number of distinct locations used to access this account in the last 24 hours
account.locationCount.last7days	integer	The number of distinct locations used to access this account in the last 7 days
account.loginFailedCount.last24hours	integer	The number of login failed events seen for this account in the last 24 hours
account.loginFailedCount.last7days	integer	The number of login failed events seen for this account in the last 7 days
account.loginFailedCount.lastHour	integer	The number of login failed events seen for this account in the last hour
account.loginSuccessCount.last24hours	integer	The number of login success events seen for this account in the last 24 hours
account.loginSuccessCount.last7days	integer	The number of login success events seen for this account in the last 7 days
account.loginSuccessCount.lastHour	integer	The number of events seen for this account in the last hour
account.mfaFailedCount.last24hours	integer	The number of MFA failed events seen for this account in the last 24 hours
account.mfaFailedCount.last7days	integer	The number of MFA failed events seen for this account in the last 7 days
account.mfaFailedCount.lastHour	integer	The number of MFA failed events seen for this account in the last hour
account.mfaSuccessCount.last24hours	integer	The number of MFA success events seen for this account in the last 24 hours
account.mfaSuccessCount.last7days	integer	The number of MFA success events seen for this account in the last 7 days
account.mfaSuccessCount.lastHour	integer	The number of MFA success events seen for this account in the last hour
account.userAgentCount.last24hours	integer	The number of distinct user agents used to access this account in the last 24 hours
account.userAgentCount.last7days	integer	The number of distinct user agents used to access this account in the last 7 days
account.verificationSuccessCount. last24hours	integer	The number of verification success events seen for this account in the last 24 hours
account.verificationSuccessCount. last7days	integer	The number of verification success events seen for this account in the last 7 days
account.verificationSuccessCount. lastHour	integer	The number of verification success events seen for this account in the last hour
account.verificationSuccessCount.total	integer	The total number of verification success events seen for this account in the last 180 days

Email Address Evaluation

Signal	Type	Description
email.breachInfo.breaches	array	Array containing data about every time the email was breached
email.breachInfo.count	integer	Determines if an email is found in any known breaches and the number of breaches
email.breachInfo.daysSinceLastBreach	integer	Identifies the time in days since the last breach in which the email was found
email.breachInfo.mostRecentBreachDate	string	Determines if an email is found in a breach, specified by date
email.breachInfo.yearsSinceLastBreach	integer	Identifies the time in years since the email was found in a breach
email.domain	string	Domain name of the email in a normalized format
email.domainRegistrationInfo. daysSinceDomainRegistered	integer	Identifies the time in days since the email domain was registered
email.domainRegistrationInfo. domainRegistrationDate	string	Specifies a date by which the email domain should have been registered
email.domainRegistrationInfo. yearsSinceDomainRegistered	integer	Identifies the time in years since the email domain was registered
email.emailServer	string	Specifies an email server name
email.riskScore	integer	Specifies a risk value for an email between 0 (safe) and 100 (risky) for Verosint to assess against OSINT data and internal algorithms

Event Evaluation

Signal	Type	Description
event.anomaly.components	array	In the same sort order as the fields, this contains the percentage the field contributed to the anomaly score
event.anomaly.fields	array	Sorted from most to least, these are the fields that contributed to the Anomaly Score
event.anomalyScore	integer	Specifies an anomaly value for the event between 0 (normal) and 100 (highly unusual) relative to the account’s history
event.lists	array	Event is on these lists
event.riskScore	integer	Specifies a risk value for an event between 0 (safe) and 100 (risky) based on OSINT data and internal algorithms
event.risks	array	See details in the table
event.travel.distanceMiles	number	Distance in miles from the location of the last LOGIN_SUCCESS
event.travel.mph	number	Speed of travel in miles per hour from the location of the last LOGIN_SUCCESS to the current location
event.travel.previousEventID	string	Verosint ID of the last LOGIN_SUCCESS event used for calculations

Risk Signals Associated With The Event

Value	Description
ACCOUNT:ACCOUNT_SHARING	Multiple users share credentials to access an account authorized for a single user
ACCOUNT:DORMANT_ACCOUNT	This account has not been active in this workspace for 90 days
ACCOUNT:OUTLIER_ACCOUNT	Indicates unusual activity relative to other accounts in this workspace
ACCOUNT:TAKE_OVER	Indicates that the account has been accessed through unusual activity
EMAIL:ALIAS	Indicates if the email address is an alias, usually due to special characters (+ or -) in the username
EMAIL:BREACHED	Email was breached at least once in the last 2 years
EMAIL:DISPOSABLE	Determines if an email is temporary and expires after a certain period of time
EMAIL:FREE	Indicates if the email has been registered with a free email provider such as Gmail or Yahoo
EMAIL:GENERIC	Indicates if the username portion of the email address is categorized as generic. For example, [email protected]
EMAIL:INVALID	The supplied email address is invalid
EMAIL:INVALID_A	Determines if an email’s domain has a valid IP address record
EMAIL:INVALID_DNS	Determines if an email’s domain has valid nameserver records
EMAIL:INVALID_DOMAIN	Determines if an email's domain is registered
EMAIL:INVALID_ICANN_SUFFIX	Validates that an email's top-level domain is maintained by the Internet Corporation for Assigned Names and Numbers (ICANN)
EMAIL:INVALID_MX	Validates that an email’s domain has one or more valid mail exchanger (MX) records
EMAIL:INVALID_SPF	Validates that an email’s domain has a valid sender policy framework (SPF) record
EMAIL:PARKED	Identifies if the email is from a parked domain
EMAIL:RELAY	Identifies if the email is forwarded to another email address
EMAIL:RISKY_TLD	Determines if an email is associated with a risky top-level domain
EVENT:ANOMALOUS_EVENT	Indicates an Anomaly Score ≥ 75, signaling highly unusual activity relative to the account’s history
EVENT:IMPOSSIBLE_TRAVEL	The speed of travel between a user's last known location and current location is not possible
EVENT:NEW_PRINT	New prints indicate outlier activity (such as a new device)
EVENT:STUFFING_ATTACK	Indicates that the ASN or IP address of an event is currently attempting to access multiple accounts at an unnatural speed
EVENT:VERIFIED_PRINT	Print was used to successfully verify the identity of the account
IP:ACTIVE_TOR	Determines if an IP address is coming from a currently active Tor node, usually to hide a true IP address
IP:BOT	Determines if an IP address is a known bot
IP:CRAWLER	Determines if an IP belongs to a business that scans the Internet, typically for the purpose of web indexing
IP:DENY_LIST	Checks if the IP address is on a deny list
IP:HOSTED	Determines if the IP address belongs to a cloud provider
IP:INVALID	The supplied IP address is invalid
IP:MALICIOUS	Determines if an incoming IP address can be found in a reported scam, breach, or malicious attack
IP:NONROUTABLE	The IP address is classified as non-routable
IP:PROXY	Determines if an IP address is coming from a proxy server, both HTTP and non-HTTP (such as SOCKS) proxies
IP:RELAY	Private relay service IP address (such as Apple relay, Cloudflare, or Akamai)
IP:TOR	Identifies if an IP address is coming from a known Tor exit node
IP:VPN	Identifies if an IP address is coming from a known VPN
PAYMENT_HASH:SHARED_PAYMENT_METHOD	Payment Hash was linked to multiple accounts
PHONE:DISPOSABLE	Determines if a phone number is temporary and expires after a certain period of time
PHONE:DO_NOT_ORIGINATE	Determines if an account's phone number is on the Do Not Originate (DNO) registry, which lists numbers used only for inbound calls
PHONE:INVALID	The supplied phone number is invalid
PHONE:NOT_REACHABLE	Determines if a phone number is in service or out of service
PHONE:PORTED	Determines if a phone number has been ported
PHONE:WIRELESS	Determines the phone number type (mobile and prepaid phone numbers will have a value of True, voice-over-IP and traditional landlines will have a value of False)
PRINT:MULTIPLE_ACCOUNTS	Print was linked to multiple accounts for fraudulent purposes (such as promotions abuse or a banned user)
SESSION:SESSION_SHARING	Multiple users share the same session identifier to access an account authorized for a single user
USERAGENT:BOT	Identifies if the user agent is a known bot
USERAGENT:OBSOLETE	Identifies if the user agent is obsolete

Request Identifiers

Signal	Type	Description
identifiers.accountId	string	The account ID
identifiers.deviceId	string	The device ID
identifiers.email	string	The email address
identifiers.ip	string	The IPv4 or IPv6 address
identifiers.paymentHash	string	The hashed payment method identifier
identifiers.phone	string	The phone number in E.164 format
identifiers.printId	string	The print ID
identifiers.sessionId	string	The session ID
identifiers.targetApp	string	The application accessed
identifiers.timestamp	string	The RFC3339 formatted timestamp. Current time is used if not specified
identifiers.userAgent	string	The full user agent string

IP Address Evaluation

Signal	Type	Description
ip.asn	string	Identifies the Autonomous System Number of the IP assigned to a group of IP prefixes run by network operators that maintain a defined routing policy to the Internet
ip.asnInfo.size	string	Size class expressed in t-shirt sizes that reflect the available IP addresses in the ASN
ip.aso	string	Identifies the Autonomous System Organization that administers the IP address
ip.geo.latitude	number	Identifies the location coordinate of the IP address north or south of the equator
ip.geo.longitude	number	Identifies the location coordinate of the IP address east or west of the prime meridian
ip.location.city	string	Identifies the city in which the IP address is located
ip.location.continent	string	Identifies the two-letter continent code (ISO 3166-1) from which an IP address is located
ip.location.country	string	Identifies the two-letter country code (ISO 3166-1) from which an IP address is located
ip.location.region	string	Identifies the geographical region (state/province) in which the IP is located
ip.location.regionCode	string	Identifies the two-letter region code from which an IP address is located
ip.locationId	string	Unique identifier assigned to the location by GeoNames
ip.network.cidr	string	Network address in the CIDR (Classless Inter-Domain Routing) format
ip.network.size	string	Size class expressed in t-shirt sizes that reflect the available IP addresses in the network
ip.privacyProvider	string	Name of the IP privacy service provider, available when vpn, relay, hosted or proxy is true
ip.riskScore	integer	Specifies a risk value for an IP address between 0 (safe) and 100 (risky) for Verosint to assess against OSINT data and internal algorithms
ip.signupSuccessCount.last24hours	integer	The number of signup success events seen for this IP in the last 24 hours
ip.signupSuccessCount.last7days	integer	The number of signup success events seen for this IP in the last 7 days
ip.signupSuccessCount.lastHour	integer	The number of signup success events seen for this IP in the last hour
ip.timezone	string	Identifies the timezone of an IP address
ip.type	string	The type of business using the IP address such as isp, hosting, education

Phone Number Evaluation

Signal	Type	Description
phone.carrier	string	Specifies the name of a phone service provider
phone.carrierIdentificationCode	string	Specifies the carrier identification code (CIC), a four-digit numeric code assigned to carriers or other entities that access a local exchange carrier (LEC) network
phone.location.country	string	Specifies the two-letter country code (ISO 3166-1) where the phone number is registered
phone.mobileCountryCode	string	Specifies a mobile country code (MCC)
phone.mobileNetworkCode	string	Specifies a mobile network code (MNC)
phone.riskScore	integer	Specifies a risk value for a phone number between 0 (safe) and 100 (risky) for Verosint to assess against OSINT data and internal algorithms
phone.type	string	Identifies the specified phone number type such as wireless, a fixed line, or Voice Over IP

SignalPrint Evaluation

Signal	Type	Description
print.connectedAccounts.count	integer	The number of other accounts connected to this print in SignalPrint
print.eventCount.last24hours	integer	The number of events seen for this print in the last 24 hours
print.eventCount.last7days	integer	The number of events seen for this print in the last 7 days
print.eventCount.lastHour	integer	The number of events seen for this print in the last hour
print.failedAcctsCount.last24hours	integer	The number of accounts with a a failed login connected to this print in the last 24 hours
print.failedAcctsCount.last7days	integer	The number of accounts with a a failed login connected to this print in the last 7 days
print.failedAcctsCount.lastHour	integer	The number of accounts with a a failed login connected to this print in the last hour
print.identificationMethod	string	Specifies the method used to calculate the print ID. Possible values are PROVIDED (the ID is provided with the event) and PRINT (Verosint generates the ID)
print.loginFailedCount.last24hours	integer	The number of login failed events seen for this print in the last 24 hours
print.loginFailedCount.last7days	integer	The number of login failed events seen for this print in the last 7 days
print.loginFailedCount.lastHour	integer	The number of login failed events seen for this print in the last hour
print.loginSuccessCount.last24hours	integer	The number of login success events seen for this print in the last 24 hours
print.loginSuccessCount.last7days	integer	The number of login success events seen for this print in the last 7 days
print.loginSuccessCount.lastHour	integer	The number of events seen for this print in the last hour
print.mfaFailedCount.last24hours	integer	The number of MFA failed events seen for this print in the last 24 hours
print.mfaFailedCount.last7days	integer	The number of MFA failed events seen for this print in the last 7 days
print.mfaFailedCount.lastHour	integer	The number of MFA failed events seen for this print in the last hour
print.mfaSuccessCount.last24hours	integer	The number of MFA success events seen for this print in the last 24 hours
print.mfaSuccessCount.last7days	integer	The number of MFA success events seen for this print in the last 7 days
print.mfaSuccessCount.lastHour	integer	The number of MFA success events seen for this print in the last hour
print.signupFailedCount.last24hours	integer	The number of signup failed events seen for this print in the last 24 hours
print.signupFailedCount.last7days	integer	The number of signup failed events seen for this print in the last 7 days
print.signupFailedCount.lastHour	integer	The number of signup failed events seen for this print in the last hour
print.signupSuccessCount.last24hours	integer	The number of signup success events seen for this print in the last 24 hours
print.signupSuccessCount.last7days	integer	The number of signup success events seen for this print in the last 7 days
print.signupSuccessCount.lastHour	integer	The number of signup success events seen for this print in the last hour
print.verificationSuccessCount. last24hours	integer	The number of verification success events seen for this print in the last 24 hours
print.verificationSuccessCount. last7days	integer	The number of verification success events seen for this print in the last 7 days
print.verificationSuccessCount.lastHour	integer	The number of verification success events seen for this print in the last hour
print.verificationSuccessCount.total	integer	The total number of verification success events seen for this print in the last 180 days

Session Evaluation

Signal	Type	Description
session.hoursSinceFirstSeen	number	Hours since Verosint first saw this Session ID

User Agent Evaluation

Signal	Type	Description
userAgent.browser.name	string	Identifies the name of the browser, such as Safari
userAgent.browser.version	string	Identifies the version of the browser
userAgent.daysSinceRelease	integer	Identifies the time in days since the user agent was released
userAgent.device.name	string	Identifies the name of the device
userAgent.device.type	string	Identifies the type of device
userAgent.os.name	string	Identifies the operating system on the device
userAgent.os.version	string	Identifies the version of the operating system on the device