IP Address
What it entails
IP Address checks classify connection types (TOR, VPN, data center, mobile, residential) and validate geolocation consistency against provided addresses. They detect anonymizing networks, cloud proxies, and geographical anomalies.
Why it works
Fraudsters hide behind anonymizers, cloud hosts, or mobile proxies to obfuscate true origin. Discrepancies between IP location and declared address expose proxy or VPN usage.
Checks
The following are the distinct IDs and types of checks that are included in the IP Address Check Package.
IP_TYPE
Classification of IP address source.
Value | Name | Description |
---|---|---|
TOR | TOR Node detected | A very high-risk IP, as Tor and anonymizers are commonly linked to privacy-conscious users but are also frequently associated with criminal activity, malware, and fraud attempts. |
VPN | VPN detected | A high-risk IP, typically used to mask the user’s true location or identity. While some VPN use may be legitimate (e.g., privacy concerns), it can often be used for malicious activity like fraud or evading detection. |
DATA_CENTER | Data center detected | A medium-risk IP, often tied to cloud providers or web hosts, sometimes used by bots, scrapers, or automated systems. |
UNKNOWN | Unknown IP type | The IP type could not be determined, so the risk level is slightly elevated. |
MOBILE | Mobile IP address detected | A low-risk IP address, often tied to mobile devices, which are typically used by individuals. |
RESIDENTIAL_OR_BUSINESS | Residential IP address detected | A low-risk IP address tied to an individual’s home or business, often connected, with typical user behavior patterns. |
NONE | No IP address provided | No IP address provided, no checks to be run. |
IP_GEOLOCATION_MISMATCH
IP geolocation vs. provided address.
Value | Name | Description |
---|---|---|
TRUE | IP geolocation mismatch | The IP geolocation does not match the provided address, indicating potential fraud. |
FALSE | IP geolocation matches | The IP geolocation matches the provided address, indicating legitimate connection. |
UNKNOWN | No IP geolocation information available | No IP geolocation information available. |
Updated about 1 month ago