Signal Definitions
Verosint uses signals to evaluate accounts for fraud based on open-source intelligence data. Account fraud can be determined through IP address, email, and phone data characteristics. Once fraud is found, signals power rules to guard against unwanted access to your systems.
Account Evaluation
Signal | Type | Description |
---|---|---|
account.accountSharing | boolean | Multiple users share credentials to access an account authorized for a single user |
account.asnCount.last24hours | integer | The number of distinct ASNs used to access this account in the last 24 hours |
account.asnCount.last30days | integer | The number of distinct ASNs used to access this account in the last 30 days |
account.asnCount.last7days | integer | The number of distinct ASNs used to access this account in the last 7 days |
account.asnCount.total | integer | The total number of distinct ASNs used to access this account |
account.asoCount.last24hours | integer | The number of distinct ISPs used to access this account in the last 24 hours |
account.asoCount.last30days | integer | The number of distinct ISPs used to access this account in the last 30 days |
account.asoCount.last7days | integer | The number of distinct ISPs used to access this account in the last 7 days |
account.asoCount.total | integer | The total number of distinct ISPs used to access this account |
account.connectedAccounts.count | integer | The number of other accounts connected to this print in SignalPrint |
account.eventCount.last24hours | integer | The number of events seen for this account in the last 24 hours |
account.eventCount.last30days | integer | The number of events seen for this account in the last 30 days |
account.eventCount.last7days | integer | The number of events seen for this account in the last 7 days |
account.eventCount.lastHour | integer | The number of events seen for this account in the last hour |
account.eventCount.total | integer | The total number of events seen for this account |
account.firstSeen | string | Date on which the account was first seen in an event |
account.lastSeen | string | Date on which the account was last seen in an event |
account.locationCount.last24hours | integer | The number of distinct locations used to access this account in the last 24 hours |
account.locationCount.last30days | integer | The number of distinct locations used to access this account in the last 30 days |
account.locationCount.last7days | integer | The number of distinct locations used to access this account in the last 7 days |
account.locationCount.total | integer | The total number of distinct locations used to access this account |
account.loginFailedCount.last24hours | integer | The number of login failed events seen for this account in the last 24 hours |
account.loginFailedCount.last30days | integer | The number of login failed events seen for this account in the last 30 days |
account.loginFailedCount.last7days | integer | The number of login failed events seen for this account in the last 7 days |
account.loginFailedCount.lastHour | integer | The number of login failed events seen for this account in the last hour |
account.loginFailedCount.total | integer | The total number of login failed events seen for this account |
account.loginSuccessCount.last24hours | integer | The number of login success events seen for this account in the last 24 hours |
account.loginSuccessCount.last30days | integer | The number of login success events seen for this account in the last 30 days |
account.loginSuccessCount.last7days | integer | The number of login success events seen for this account in the last 7 days |
account.loginSuccessCount.lastHour | integer | The number of events seen for this account in the last hour |
account.loginSuccessCount.total | integer | The total number of login success events seen for this account |
account.mfaFailedCount.last24hours | integer | The number of MFA failed events seen for this account in the last 24 hours |
account.mfaFailedCount.last30days | integer | The number of MFA failed events seen for this account in the last 30 days |
account.mfaFailedCount.last7days | integer | The number of MFA failed events seen for this account in the last 7 days |
account.mfaFailedCount.lastHour | integer | The number of MFA failed events seen for this account in the last hour |
account.mfaFailedCount.total | integer | The total number of MFA failed events seen for this account |
account.mfaSuccessCount.last24hours | integer | The number of MFA success events seen for this account in the last 24 hours |
account.mfaSuccessCount.last30days | integer | The number of MFA success events seen for this account in the last 30 days |
account.mfaSuccessCount.last7days | integer | The number of MFA success events seen for this account in the last 7 days |
account.mfaSuccessCount.lastHour | integer | The number of MFA success events seen for this account in the last hour |
account.mfaSuccessCount.total | integer | The total number of MFA success events seen for this account |
account.multipleAccounts | boolean | Multiple accounts created for a single user for fraudulent purposes (such as promotions abuse or a banned user) |
account.tags | array | The tags directly associated with this account or connected through other accounts in SignalPrint |
account.userAgentCount.last24hours | integer | The number of distinct user agents used to access this account in the last 24 hours |
account.userAgentCount.last30days | integer | The number of distinct user agents used to access this account in the last 30 days |
account.userAgentCount.last7days | integer | The number of distinct user agents used to access this account in the last 7 days |
account.userAgentCount.total | integer | The total number of distinct user agents used to access this account |
account.verificationSuccessCount. last24hours | integer | The number of verification success events seen for this account in the last 24 hours |
account.verificationSuccessCount. last30days | integer | The number of verification success events seen for this account in the last 30 days |
account.verificationSuccessCount. last7days | integer | The number of verification success events seen for this account in the last 7 days |
account.verificationSuccessCount. lastHour | integer | The number of verification success events seen for this account in the last hour |
account.verificationSuccessCount.total | integer | The total number of verification success events seen for this account |
Email Address Evaluation
Signal | Type | Description |
---|---|---|
email.alias | boolean | Indicates if the email address is an alias, usually due to special characters (+ or -) in the username |
email.breachInfo.breaches | array | Array containing data about every time the email was breached |
email.breachInfo.count | integer | Determines if an email is found in any known breaches and the number of breaches |
email.breachInfo.daysSinceLastBreach | integer | Identifies the time in days since the last breach in which the email was found |
email.breachInfo.mostRecentBreachDate | string | Determines if an email is found in a breach, specified by date |
email.breachInfo.yearsSinceLastBreach | integer | Identifies the time in years since the email was found in a breach |
email.disposable | boolean | Determines if an email is temporary and expires after a certain period of time |
email.domainRegistrationInfo. daysSinceDomainRegistered | integer | Identifies the time in days since the email domain was registered |
email.domainRegistrationInfo. domainRegistrationDate | string | Specifies a date by which the email domain should have been registered |
email.domainRegistrationInfo. yearsSinceDomainRegistered | integer | Identifies the time in years since the email domain was registered |
email.emailServer | string | Specifies an email server name |
email.free | boolean | Indicates if the email has been registered with a free email provider such as Gmail or Yahoo |
email.generic | boolean | Indicates if the username portion of the email address is categorized as generic. For example, [email protected] |
email.riskScore | integer | Specifies a risk value for an email between 0 (safe) and 100 (risky) for Verosint to assess against OSINT data and internal algorithms |
email.riskyTLD | boolean | Determines if an email is associated with a risky top-level domain |
email.validA | boolean | Determines if an email’s domain has a valid IP address record |
email.validDNS | boolean | Determines if an email’s domain has valid nameserver records |
email.validDomain | boolean | Determines if an email's domain is registered |
email.validICANNSuffix | boolean | Validates that an email's top-level domain is maintained by the Internet Corporation for Assigned Names and Numbers (ICANN) |
email.validMX | boolean | Validates that an email’s domain has one or more valid mail exchanger (MX) records |
email.validSPF | boolean | Validates that an email’s domain has a valid sender policy framework (SPF) record |
Event Evaluation
Signal | Type | Description |
---|---|---|
event.impossibleTravel | boolean | Checks if the speed of travel between a user's last known location and current location is possible. If speed > 600 MPH, it's impossible travel |
event.newPrint | boolean | Checks if the print was used to successfully login to the account. New prints indicate outlier activity (such as a new device) |
event.riskScore | integer | Specifies a risk value for an event between 0 (safe) and 100 (risky) for Verosint to assess against OSINT data and internal algorithms |
event.verifiedPrint | boolean | Checks if the print was used to successfully verify the identity of the account |
Request Identifiers
Signal | Type | Description |
---|---|---|
identifiers.accountId | string | The account ID |
identifiers.email | string | The email address |
identifiers.ip | string | The IPv4 or IPv6 address |
identifiers.phone | string | The phone number in E.164 format |
identifiers.timestamp | string | The RFC3339 formatted timestamp. Current time is used if not specified |
identifiers.userAgent | string | The full user agent string |
IP Address Evaluation
Signal | Type | Description |
---|---|---|
ip.activeTor | boolean | Determines if an IP address is coming from a currently active Tor node, usually to hide a true IP address |
ip.asn | string | Identifies the Autonomous System Number of the IP assigned to a group of IP prefixes run by network operators that maintain a defined routing policy to the Internet |
ip.aso | string | Identifies the Autonomous System Organization that administers the IP address |
ip.bot | boolean | Determines if an IP address is a known bot |
ip.crawler | boolean | Determines if an IP belongs to a business that scans the Internet, typically for the purpose of web indexing |
ip.denyList | boolean | Checks if the IP address is on a deny list |
ip.geo.latitude | number | Identifies the location coordinate of the IP address north or south of the equator |
ip.geo.longitude | number | Identifies the location coordinate of the IP address east or west of the prime meridian |
ip.hosted | boolean | Determines if the IP address belongs to a cloud provider |
ip.location.city | string | Identifies the city in which the IP address is located |
ip.location.continent | string | Identifies the two-letter continent code (ISO 3166-1) from which an IP address is located |
ip.location.country | string | Identifies the two-digit country code (ISO 3166-1) from which an IP address is located |
ip.location.region | string | Identifies the geographical region (state/province) in which the IP is located |
ip.locationId | string | Unique identifier assigned to the location by GeoNames |
ip.malicious | boolean | Determines if an incoming IP address can be found in a reported scam, breach, or malicious attack |
ip.proxy | boolean | Determines if an IP address is coming from a proxy server, both HTTP and non-HTTP (such as SOCKS) proxies |
ip.relay | boolean | Private relay service IP address (such as Apple relay, Cloudflare, or Akamai) |
ip.riskScore | integer | Specifies a risk value for an IP address between 0 (safe) and 100 (risky) for Verosint to assess against OSINT data and internal algorithms |
ip.timezone | string | Identifies the timezone of an IP address |
ip.tor | boolean | Identifies if an IP address is coming from a known Tor exit node |
ip.vpn | boolean | Identifies if an IP address is coming from a known VPN |
Phone Number Evaluation
Signal | Type | Description |
---|---|---|
phone.carrier | string | Specifies the name of a phone service provider |
phone.carrierIdentificationCode | string | Specifies the carrier identification code (CIC), a four-digit numeric code assigned to carriers or other entities that access a local exchange carrier (LEC) network |
phone.disposable | boolean | Determines if a phone number is temporary and expires after a certain period of time |
phone.doNotOriginate | boolean | Determines if an account's phone number is on the Do Not Originate (DNO) registry, which lists numbers used only for inbound calls |
phone.location.country | string | Specifies the two-digit country code (ISO 3166-1) where the phone number is registered |
phone.location.region | string | Specifies the geographical region (state/province) in which the phone is located |
phone.mobileCountryCode | string | Specifies a mobile country code (MCC) |
phone.mobileNetworkCode | string | Specifies a mobile network code (MNC) |
phone.numberPortabilityDipIndicator | boolean | Determines if a phone number has been queried through a number portability lookup |
phone.numberPortedIndicator | boolean | Determines if a phone number has been ported |
phone.reachable | boolean | Determines if a phone number is in service or out of service |
phone.riskScore | integer | Specifies a risk value for a phone number between 0 (safe) and 100 (risky) for Verosint to assess against OSINT data and internal algorithms |
phone.wireless | boolean | Determines the phone number type (mobile and prepaid phone numbers will have a value of True, voice-over-IP and traditional landlines will have a value of False) |
SignalPrint Evaluation
Signal | Type | Description |
---|---|---|
print.connectedAccounts.avgDegrees | number | The average number of degrees to the connected accounts in SignalPrint |
print.connectedAccounts.count | integer | The number of other accounts connected to this account in SignalPrint |
print.connectedAccounts.maxDegrees | integer | The maximum number of degrees to the connected accounts in SignalPrint |
print.connectedAccounts.minDegrees | integer | The minimum number of degrees to the connected accounts in SignalPrint |
print.connectedPrints.avgDegrees | number | The average number of degrees to the connected prints in SignalPrint |
print.connectedPrints.count | integer | The number of other prints connected to this print in SignalPrint |
print.connectedPrints.maxDegrees | integer | The maximum number of degrees to a connected print in SignalPrint |
print.connectedPrints.minDegrees | integer | The minimum number of degrees to a connected print in SignalPrint |
print.eventCount.last24hours | integer | The number of events seen for this print in the last 24 hours |
print.eventCount.last30days | integer | The number of events seen for this print in the last 30 days |
print.eventCount.last7days | integer | The number of events seen for this print in the last 7 days |
print.eventCount.lastHour | integer | The number of events seen for this print in the last hour |
print.eventCount.total | integer | The total number of events seen for this print |
print.failedAcctsCount.last24hours | integer | The number of accounts with a a failed login connected to this print in the last 24 hours |
print.failedAcctsCount.last30days | integer | The number of accounts with a a failed login connected to this print in the last 30 days |
print.failedAcctsCount.last7days | integer | The number of accounts with a a failed login connected to this print in the last 7 days |
print.failedAcctsCount.lastHour | integer | The number of accounts with a a failed login connected to this print in the last hour |
print.failedAcctsCount.total | integer | The total number of accounts with a a failed login connected to this print |
print.firstSeen | string | Date on which the print was first seen in an event |
print.lastSeen | string | Date on which the print was last seen in an event |
print.loginFailedCount.last24hours | integer | The number of login failed events seen for this print in the last 24 hours |
print.loginFailedCount.last30days | integer | The number of login failed events seen for this print in the last 30 days |
print.loginFailedCount.last7days | integer | The number of login failed events seen for this print in the last 7 days |
print.loginFailedCount.lastHour | integer | The number of login failed events seen for this print in the last hour |
print.loginFailedCount.total | integer | The total number of login failed events seen for this print |
print.loginSuccessCount.last24hours | integer | The number of login success events seen for this print in the last 24 hours |
print.loginSuccessCount.last30days | integer | The number of login success events seen for this print in the last 30 days |
print.loginSuccessCount.last7days | integer | The number of login success events seen for this print in the last 7 days |
print.loginSuccessCount.lastHour | integer | The number of events seen for this print in the last hour |
print.loginSuccessCount.total | integer | The total number of login success events seen for this print |
print.mfaFailedCount.last24hours | integer | The number of MFA failed events seen for this print in the last 24 hours |
print.mfaFailedCount.last30days | integer | The number of MFA failed events seen for this print in the last 30 days |
print.mfaFailedCount.last7days | integer | The number of MFA failed events seen for this print in the last 7 days |
print.mfaFailedCount.lastHour | integer | The number of MFA failed events seen for this print in the last hour |
print.mfaFailedCount.total | integer | The total number of MFA failed events seen for this print |
print.mfaSuccessCount.last24hours | integer | The number of MFA success events seen for this print in the last 24 hours |
print.mfaSuccessCount.last30days | integer | The number of MFA success events seen for this print in the last 30 days |
print.mfaSuccessCount.last7days | integer | The number of MFA success events seen for this print in the last 7 days |
print.mfaSuccessCount.lastHour | integer | The number of MFA success events seen for this print in the last hour |
print.mfaSuccessCount.total | integer | The total number of MFA success events seen for this print |
print.multipleAccounts | boolean | Checks if this print was linked to multiple accounts for fraudulent purposes (such as promotions abuse or a banned user) |
print.tags | array | The tags associated to accounts connected through prints in SignalPrint |
print.verificationSuccessCount. last24hours | integer | The number of verification success events seen for this print in the last 24 hours |
print.verificationSuccessCount. last30days | integer | The number of verification success events seen for this print in the last 30 days |
print.verificationSuccessCount. last7days | integer | The number of verification success events seen for this print in the last 7 days |
print.verificationSuccessCount.lastHour | integer | The number of verification success events seen for this print in the last hour |
print.verificationSuccessCount.total | integer | The total number of verification success events seen for this print |
User Agent Evaluation
Signal | Type | Description |
---|---|---|
userAgent.bot | boolean | Identifies if the user agent is a known bot |
userAgent.browser.name | string | Identifies the name of the browser, such as Safari |
userAgent.browser.version | string | Identifies the version of the browser |
userAgent.device.name | string | Identifies the name of the device |
userAgent.device.type | string | Identifies the type of device |
userAgent.os.name | string | Identifies the operating system on the device |
userAgent.os.version | string | Identifies the version of the operating system on the device |
Updated about 5 hours ago