Signals are grouped by what they tell you. Events read with a secret key list triggers by group; the identify response and the visitor.suspect webhook name the individual signal and its group. The dashboard's Smart Signals > Signal reference lists every individual signal.
Signal groups
| Group | Key | Meaning | Web | Android | iOS |
|---|---|---|---|---|---|
| Tor exit node | tor | The connection arrives from the Tor network. | 14 | 16 | 17 |
| Datacenter proxy | datacenter_proxy | The address belongs to a proxy or a hosting provider rather than a consumer connection. | 14 | 12 | 15 |
| Residential proxy | residential_proxy | Traffic is relayed through someone else's home connection. | 6 | 6 | 6 |
| VPN | vpn | The connection arrives over a VPN. | 4 | 6 | 6 |
| IP reputation | ip_reputation | The address has a recent history of abuse. | 8 | 8 | 8 |
| IP blocklist | ip_blocklist | The address is on a public blocklist for sending spam or for attacks. | 14 | 13 | 13 |
| Location spoofing | location_spoofing | The device's own location settings disagree with where its connection is. | 5 | 5 | 5 |
| Network anomaly | network_anomaly | The address should not appear on the public internet. Off by default. | 0 | 0 | 0 |
| Bot | bot | The client is automated, or says it is a bot. | 9 | n/a | n/a |
| Virtual machine | virtual_machine | The browser runs inside a virtual machine. | 14 | n/a | n/a |
| Remote control | remote_control | The session is driven through remote desktop software, as in many support scams. | 14 | n/a | n/a |
| Browser tampering | browser_tampering | The runtime has been modified, or claims to be something it is not. | 8 | 8 | 8 |
| Fingerprint suppressed | fingerprint_suppressed | Too little was collected to identify the device. | 16 | 16 | 16 |
| Incognito mode | incognito_mode | The page is in a private browsing window. | 4 | n/a | n/a |
| Privacy settings | privacy_settings | The browser runs hardened privacy settings. | 6 | n/a | n/a |
| High activity | high_activity | The device has been seen far more often than an ordinary one. | 6 | 5 | 6 |
| Device farm | device_farm | The device looks mass-provisioned or freshly reset, or shares traits with many devices at once. | 7 | 8 | 8 |
| Developer tools | developer_tools | A debugger or developer tooling is attached. | n/a | 8 | 16 |
| Rooted device | rooted_device | The Android device is rooted. | n/a | 12 | n/a |
| Android emulator | android_emulator | The app runs in an Android emulator. | n/a | 9 | n/a |
| Cloned app | cloned_app | The app runs inside a cloning framework, or is not your signed build. | n/a | 9 | n/a |
| Jailbroken device | jailbroken_device | The iOS device is jailbroken. | n/a | n/a | 10 |
| iOS simulator | ios_simulator | The app runs in the iOS Simulator. | n/a | n/a | 16 |
| Instrumentation | frida_detected | An instrumentation toolkit is attached to the app. | n/a | 14 | 14 |
| MITM attack | mitm_attack | Something is intercepting the app's encrypted traffic. | n/a | 14 | 14 |
| Active call | active_call | The device is on a phone call during the action, a common pattern in scams. | n/a | 3 | 3 |
Weights are the defaults for each platform: a group's weight is its heaviest signal's. n/a means the group does not apply on that platform, which is different from a weight of 0.
Network signals
Network signals come from the visitor's IP address and apply to every platform. The same lookup fills in country_code, asn, asn_name and anonymity_network on the event.
VPN and residential proxy findings carry a confidence from how many independent indications agree. You can weigh them by how they were recognised, or by that confidence. See weighting modes.
Device and runtime signals
Device signals come from the SDK's report and are checked again on the server. On iOS and Android, the native SDKs reach what JavaScript cannot, which is why mobile has signals such as rooted and jailbroken devices, emulators and instrumentation.
Behaviour signals
high_activity and the cross-device part of device_farm compare a device with your own traffic over the last 5 minutes, hour and day. They learn what normal looks like for each environment and platform first: until there are at least 1,000 identifications and 7 days of history, they are reported but add nothing to the score.
Signal names are permanent
A signal's name never changes meaning. If what a detection measures changes, it becomes a new signal with a new name, so rules you write against today's names stay correct.