IP Trait Risk Data

IP traits include user context and IP usage analysis data of the IP address which can give you a better idea of how the IP address is used, by whom, and by how many people. This includes:

These data points will only be returned when you pass the IP address as an input to the minFraud Insights and Factors web services. Learn more about passing inputs to minFraud.

If you are using IP trait risk data to perform manual review, you may be interested in the IP risk reasons. Learn more about IP risk reasons.

You may also be interested in the IP risk score. The IP risk score is available in all minFraud services. Learn more about the IP risk score.

Static IP scoring

IP addresses may be frequently moved or reassigned by ISPs. We provide a rating of how static the IP address appears to be. The value ranges from 0 to 99.99 with higher values meaning that the IP address appears to be more static, and is not often reassigned.

Many IP addresses assigned to cellular networks return a lower score, under 1.0, because cellular IPs typically serve multiple on-the-move users over a larger area. Broadband IPs associated with a residential connection that don’t change as often typically have a score above 30.

This data point can be useful for assessing transaction history from a particular user over time. If they often use an IP address that has a high static IP score, you may have more confidence that this IP address is associated with that user's home or place of business, and could investigate transactions that come from a different IP address more carefully.

Screen_Shot_2021-11-17_at_10.15.29_AM.png

The static IP score is displayed under IP Address Checks - Traits in the transaction review screen in the account portal. Learn how to review transactions using the account portal.

You can read the API specifications for our static IP scoring in our developer's documentation:

User counts

The minFraud Network is able to estimate the number of distinct users who share the same IP address over the past 24 hours. A higher number of users of the same IP address indicates that this is a high-volume IP that could be associated with a corporate proxy, carrier-grade NAT, or other types of shared connections. You can use this output to get a sense of whether this connection is used by one, few, or many different users.

Screen_Shot_2021-11-17_at_10.17.04_AM.png

The user count is displayed under IP Address Checks - Traits in the transaction review screen in the account portal. Learn how to review transactions using the account portal.

You can read the API specifications for our user counts in our developer's documentation:

User types

We analyze IP registration information, traffic, and usage patterns across the minFraud network to determine how IP addresses are likely being used. We use this information to flag IP addresses according to a number of different user types. You can compare the user type of the IP address with transaction details to see if the user is of the expected type. For example, does the transaction seem like one that would be conducted by a college student or professor? Do people normally conduct transactions with your business from a university, or from users on a mobile network? If a transaction is scored as higher risk, but the user type data matches your expectation for your customer, this may be an indication that the transaction should be scored with a lower risk.

We flag the following user types:

User type Description
Business This IP address exhibits patterns of usage and transactions consistent with a business.
Cafe This IP is used by a wide variety of end-users, but also exhibits characteristics that indicate it is owned by a business. As opposed to IPs with a user type of traveler, these IPs are not likely located in hotels, airports, etc.

This user type is currently assigned very rarely.
Cellular This IP is likely part of a mobile data network, often used while end-users are away from their homes.
College This IP is part of a college or university campus network, used by college students, faculty, and other employees.
Content delivery network This IP is part of a content delivery network (CDN). CDNs are not normally used to browse the internet and conduct transactions, so if you see content delivery network IPs that may indicate that you are sending the IP of your CDN rather than that of the end user. You should work with your developers to make sure you are obtaining the end client IP by checking HTTP headers set by your CDN.
Dialup This IP uses a dial-up connection to the internet. Dial-up users are rare, so you could check to make sure this connection type is consistent with other details of the transaction.
Government This IP is part of a network used by a government agency.
Hosting This IP is used by a web hosting provider. IP addresses are only used to browse the internet and conduct end-user transactions when the end-user is using a proxy or other anonymizer. If you are seeing transactions consistent with an end-user from a hosting provider, it may be a strong indicator that the IP address is part of a VPN. Learn more about IP anonymizer risk data.
Library This IP address is part of a network used by a library.
Military This IP address is part of a network used by a military institution or base.
Residential This IP address is likely used for residential internet use.
Router This IP address is likely used by a router.

This user type is currently assigned very rarely and is not actively maintained.
School This IP address is part of a network used by a school.
Search engine spider This IP address is used by a search engine spider to index web sites.
Traveler This IP is used by a wide variety of end-users from different locations. It is likely part of a network used by guests at a hotel, travelers at an airport, or similar.

Screen_Shot_2021-11-17_at_10.18.32_AM.png

The user type is displayed under IP Address Checks - Traits in the transaction review screen in the account portal. Learn how to review transactions using the account portal.

You can read the API specifications for our user type in our developer's documentation:

This page was last updated on .

Was this article helpful?