Inside the IP signal: ASN, datacentre, VPN, proxy and Tor detection

The IP a signup arrives from says a great deal about intent. Veritus enriches it several ways.

• Geolocation and ASN lookup — powered by MaxMind GeoLite2, loaded on startup and refreshed weekly, giving country, region and the network operator (ASN) behind the address.
• Datacentre / hosting detection — traffic from hosting providers rather than consumer ISPs is identified, since genuine customers rarely sign up from a datacentre.
• VPN, proxy and Tor — exit-node and anonymiser lists are refreshed hourly. Tor exit nodes are hard-blocked by default.
• Residential-proxy heuristics — the harder-to-spot residential proxies that fraudsters use to look like ordinary home users are detected heuristically.

When one of these fires you will see a reason code such as ip.tor_exit or ip.datacentre, making the decision easy to understand and, where appropriate, override with a rule.