IP Anonymizer Risk Data

IP anonymizer risk data includes:

These data points will only be returned when you pass the IP address as an input to the minFraud Insights and Factors web services. Learn more about passing inputs to minFraud.

The minFraud services can identify many IP addresses that belong to different kinds of anonymizers, from VPNs to TOR exit nodes. End-users may use anonymizers for a variety of reasons. They may be privacy-conscious web users who do not want their personal information tracked, for example. However, anonymizers may also be used by fraudsters to conceal their identities.

If you are using IP anonymizer risk data to perform manual review, you may be interested in the IP risk reasons. Learn more about IP risk reasons.

You may also be interested in the IP risk score. The IP risk score is available in all minFraud services. Learn more about the IP risk score.

Anonymizer detection

If the IP address passed for a transaction has been flagged as any kind of anonymizer, it will be identified as such in the response. Some customers use IP anonymizers when conducting legitimate transactions, but for many businesses anonymized IP addresses are an indicator of increased risk.

The minFraud services use GeoIP2 data for some anonymizer detection. You can learn more about anonymizer detection in our GeoIP2 support article on anonymizers.

If you feel that a customer’s IP address was incorrectly flagged as an anonymizer, please contact our support team, and we will have our data review team investigate the IP. Please do not ask the customer to contact us directly.

Screen_Shot_2021-11-17_at_10.05.35_AM.png

Anonymizer detection is displayed under IP Address Checks - Traits in the transaction review screen in the account portal. Learn how to review transactions using the account portal.

You can read the API specifications for our anonymizer detection in our developer's documentation:

Types of anonymizers

The minFraud service can detect five different kinds of anonymizers: VPNs, hosting providers, public proxies, residential proxies, and TOR exit nodes.

If you feel that a customer’s IP address was incorrectly flagged as an anonymizer, please contact our support team, and we will have our data review team investigate the IP. Please do not ask the customer to contact us directly.

VPNs

Some customers use IP anonymizers when conducting legitimate transactions, but for many businesses anonymized IP addresses are an indicator of increased risk.

Screen_Shot_2021-11-17_at_10.07.38_AM.png

Anonymous VPN detection is displayed under IP Address Checks - Traits in the transaction review screen in the account portal. Learn how to review transactions using the account portal.

You can read the API specifications for our VPN detection in our developer's documentation:

Hosting providers

Web hosting services can be used to create private proxies, and many VPN services use hosting providers to host their services instead of registering their own IP ranges. This means that if you see traffic associated with an end-user coming from a hosting provider, it may be that the end-user is using a VPN, even if we have not otherwise identified it as such.

Screen_Shot_2021-11-17_at_10.09.36_AM.png

Hosting provider detection is displayed under IP Address Checks - Traits in the transaction review screen in the account portal. Learn how to review transactions using the account portal.

You can read the API specifications for our hosting provider detection in our developer's documentation:

Public proxies

Public proxies tend to be easy to access and are openly published.

Screen_Shot_2021-11-17_at_10.11.05_AM.png

Public proxy detection is displayed under IP Address Checks - Traits in the transaction review screen in the account portal. Learn how to review transactions using the account portal.

You can read the API specifications for our public proxy detection in our developer's documentation:

Residential proxies

Residential proxies are harder to detect than other kinds of proxies as these IPs appear to be associated with legitimate residential ISPs.

Screen_Shot_2021-11-17_at_10.12.08_AM.png

Residential proxy detection is displayed under IP Address Checks - Traits in the transaction review screen in the account portal. Learn how to review transactions using the account portal.

You can read the API specifications for our residential proxy detection in our developer's documentation:

TOR exit nodes

These are published IPs used as exit nodes for the TOR network. Traffic from these nodes have been relayed through several servers to preserve anonymity.

Screen_Shot_2021-11-17_at_10.13.33_AM.png

TOR exit node detection is displayed under IP Address Checks - Traits in the transaction review screen in the account portal. Learn how to review transactions using the account portal.

You can read the API specifications for our TOR exit node detection in our developer's documentation:

Other types of Proxies

In addition to the anonymizers flagged above, there are other kinds of privacy-focused networks such as Apple iCloud Private Relay that protect the identity (and sometimes the more specific geolocation) of the end-user, but include additional oversight by the companies who manage these networks. These networks are identified in our GeoIP2 organization data, which is included in all minFraud Insights and Factors responses. Learn more about these networks and how they are flagged in our GeoIP2 documentation.

This page was last updated on .

Was this article helpful?