IP Trait Risk Data

IP traits include user context and IP usage analysis data of the IP address which can give you a better idea of how the IP address is used, by whom, and by how many people. This includes:

• a static IP score,
• user counts,
• and a user type.

These data points will only be returned when you pass the IP address as an input to the minFraud Insights and Factors web services. Learn more about passing inputs to minFraud.

If you are using IP trait risk data to perform manual review, you may be interested in the IP risk reasons. Learn more about IP risk reasons.

You may also be interested in the IP risk score. The IP risk score is available in all minFraud services. Learn more about the IP risk score.

Static IP scoring

IP addresses may be frequently moved or reassigned by ISPs. We provide a rating of how static the IP address appears to be. The value ranges from 0 to 99.99 with higher values meaning that the IP address appears to be more static, and is not often reassigned.

Many IP addresses assigned to cellular networks return a lower score, under 1.0, because cellular IPs typically serve multiple on-the-move users over a larger area. Broadband IPs associated with a residential connection that don’t change as often typically have a score above 30.

This data point can be useful for assessing transaction history from a particular user over time. If they often use an IP address that has a high static IP score, you may have more confidence that this IP address is associated with that user's home or place of business, and could investigate transactions that come from a different IP address more carefully.

You can read the API specifications for our static IP scoring on our developer portal:

• /traits/static_ip_score

User counts

The minFraud Network is able to estimate the number of distinct users who share the same IP address over the past 30 days. A higher number of users of the same IP address indicates that this is a high-volume IP that could be associated with a corporate proxy, carrier-grade NAT, or other types of shared connections. You can use this output to get a sense of whether this connection is used by one, few, or many different users.

User counts of different levels may correspond to different kinds of usage:

User count	Description
0	IP assigned to a single end-user at a time ( household, person, or small business ), or not in use.
1	IP assigned to a single end-user with possibility of multiple end-users.
2-5	IP shared with multiple end-users.
> 5	IP shared with many end-users.

You can read the API specifications for our user counts on our developer portal:

• /traits/user_count

User types

We analyze IP registration information, traffic, and usage patterns across the minFraud network to determine how IP addresses are likely being used. We use this information to flag IP addresses according to a number of different user types. You can compare the user type of the IP address with transaction details to see if the user is of the expected type. For example, does the transaction seem like one that would be conducted by a college student or professor? Do people normally conduct transactions with your business from a university, or from users on a mobile network? If a transaction is scored as higher risk, but the user type data matches your expectation for your customer, this may be an indication that the transaction should be scored with a lower risk.

We flag the following user types:

User type	Description
Business	This IP address exhibits patterns of usage and transactions consistent with a business.
Cafe	This IP is used by a wide variety of end-users, but also exhibits characteristics that indicate it is owned by a business. As opposed to IPs with a user type of traveler, these IPs are not likely located in hotels, airports, etc. This user type is currently assigned very rarely.
Cellular	This IP is likely part of a mobile data network, often used while end-users are away from their homes.
College	This IP is part of a college or university campus network, used by college students, faculty, and other employees.
Content delivery network	This IP is part of a content delivery network (CDN). CDNs are not normally used to browse the internet and conduct transactions, so if you see content delivery network IPs that may indicate that you are sending the IP of your CDN rather than that of the end user. You should work with your developers to make sure you are obtaining the end client IP by checking HTTP headers set by your CDN.
Government	This IP is part of a network used by a government agency.
Hosting	This IP is used by a web hosting provider. IP addresses are only used to browse the internet and conduct end-user transactions when the end-user is using a proxy or other anonymizer. If you are seeing transactions consistent with an end-user from a hosting provider, it may be a strong indicator that the IP address is part of a VPN. Learn more about IP anonymizer risk data.
Library	This IP address is part of a network used by a library.
Military	This IP address is part of a network used by a military institution or base.
Residential	This IP address is likely used for residential internet use.
Router	This IP address is likely used by a router. This user type is currently assigned very rarely and is not actively maintained.
School	This IP address is part of a network used by a school.
Search engine spider	This IP address is used by a search engine spider to index web sites.
Traveler	This IP is used by a wide variety of end-users from different locations. It is likely part of a network used by guests at a hotel, travelers at an airport, or similar.

You can read the API specifications for our user type on our developer portal:

• /traits/user_type