Smart Signals reference

Smart signals are actionable device intelligence insights you can use to improve your fraud prevention logic. For general information about Smart Signals availability and usage, see Smart Signals Introduction.

Some signals are available on all platforms, while others are specific only to browsers or mobile devices.

Smart Signals common for browsers and mobile devices

These Smart Signals are available on all platforms.

Suspect Score

Suspect Score combines all Smart Signals into a weighted integer value based on their global probability. To read more about the weights and the mechanisms, see Suspect score.

"suspectScore": {
  "data": {
    "result": 0
  }
}

Velocity Signals

Velocity Signals sum key data points at three distinct intervals: 5 minutes, 1 hour, and 24 hours as follows:

Per visitorID :

• Number of distinct IP addresses linked to the visitorID
• Number of distinct countries associated with a visitorID
• Number of distinct linkedIDs associated with the visitorID
• Number of events linked to the visitorID

Per linkedID :

• Number of distinct IPs associated with the linkedID
• Number of distinct visitorIDs associated with the linkedID

Per IP :

• Number of events linked to an IP address

{
  "velocity": {
    "data": {
      "distinctIp": {
        "intervals": {
          "5m": 1,
          "1h": 1,
          "24h": 5
        }
      }
    }
  }
}

{
  "velocity": {
    "data": {
      "distinctCountry": {
        "intervals": {
          "5m": 1,
          "1h": 1,
          "24h": 5
        }
      }
    }
  }
}

{
  "velocity": {
    "data": {
      "distinctLinkedId": {
        "intervals": {
          "5m": 1,
          "1h": 1,
          "24h": 2
        }
      }
    }
  }
}

{
  "velocity": {
    "data": {
      "events": {
        "intervals": {
          "5m": 3,
          "1h": 5,
          "24h": 23 // For visitors exceeding 20,000 in 24 hours, we omit 24-hour aggregations
        }
      }
    }
  }
}

{
  "velocity": {
    "data": {
      "distinctIpByLinkedId": {
        "intervals": {
          "5m": 1,
          "1h": 1,
          "24h": 7
        }
      }
    }
  }
}

{
  "velocity": {
    "data": {
      "distinctVisitorIdByLinkedId": {
        "intervals": {
          "5m": 1,
          "1h": 1,
          "24h": 1
        }
      }
    }
  }
}

{
  "velocity": {
    "data": {
      "ipEvents": {
        "intervals": {
          "5m": 2,
          "1h": 2,
          "24h": 9
        }
      }
    }
  }
}

{
  "velocity": {
    "data": {
      "distinctIpByLinkedId": {
        "intervals": { } // This will be an empty object if there is no data to present
      }
    }
  }
}

For high-activity visitors exceeding a count of 20,000 within a 24-hour window, we will omit the aggregation of 24-hour results.

IP Geolocation

The geolocation field shows the estimated physical location of the client*.

The location is composed of latitude and longitude, along with an accuracy radius ranging from 5 to 1000 km. These coordinates define the center of a circle that can be mapped. The postal code has the weakest level of confidence and this mappable area would rarely fall within a single postal code.

The asn and datacenter field can be used to group ranges of IP addresses that belong to the same owner to apply protection rules against a whole block of IP addresses. They could also indicate that the visitor connects through an intermediate server instead of connecting through an ISP directly.

*The latitude and longitude map to the nearest public park or body of water to avoid confusion about whether the coordinates correspond to a person's residence or a business.

"ipInfo": {
  "data": {
    "v4": {
      "address": "94.142.239.124",
      "geolocation": {
        "accuracyRadius": 20,
        "latitude": 50.05,
        "longitude": 14.4,
        "postalCode": "150 00",
        "timezone": "Europe/Prague",
        "city": {
          "name": "Prague"
        },
        "country": {
          "code": "CZ",
          "name": "Czechia"
        },
        "continent": {
          "code": "EU",
          "name": "Europe"
        },
        "subdivisions": [
          {
            "isoCode": "10",
            "name": "Prague"
          }
        ]
      },
      "asn": {
        "asn": "7922",
        "name": "COMCAST-7922",
        "network": "73.136.0.0/13"
      },
      "datacenter": {
        "result": true,
        "name": "DediPath"
      }
    },
    "v6": {
      "address": "::ffff:5e8e:ef7c",
      "geolocation": {
        "accuracyRadius": 20,
        "latitude": 50.05,
        "longitude": 14.4,
        "postalCode": "150 00",
        "timezone": "Europe/Prague",
        "city": {
          "name": "Prague"
        },
        "country": {
          "code": "CZ",
          "name": "Czechia"
        },
        "continent": {
          "code": "EU",
          "name": "Europe"
        },
        "subdivisions": [
          {
            "isoCode": "10",
            "name": "Prague"
          }
        ]
      },
      "asn": {
        "asn": "7922",
        "name": "COMCAST-7922",
        "network": "::ffff:5e8e:ef7c/110"
      },
      "datacenter": {
        "result": true,
        "name": "DediPath"
      }
    }
  }
}

IP Blocklist Matching

Block IP addresses based on their presence in different public and proprietary blocklists.

The feature uses a combination of internal and 3rd-party IP databases to determine whether

• The IP address belongs to a public proxy provider or used by a residential proxy (currently in beta).
  • Public proxy providers are typically hosted in data centers and connect with HTTPS or SOCKS5 protocols
  • Residential proxies route internet traffic through real user devices with legitimate ISP-issued IP addresses, making requests appear as if they originate from ordinary residential users. They are commonly used for fraudulent activity, such as account takeovers or illegal content scraping
• The IP address is a known Tor exit node (tor payload)
• The IP address has been part of a network attack or email spam attack (ipBlocklist.details payload)

🚧

Residential proxy detection is currently in beta

📘

tor and proxy payloads do not utilize active Tor or proxy detection mechanisms.

"ipBlocklist": {
  "data": {
    "result": false,
    "details": {
      "emailSpam": false,
      "attackSource": false
    }
  }
}

"tor": {
  "data": {
    "result": false
  }
}

// will return true in case the device IP belongs to a web or residential proxy
// note that the residential proxy detection is currently in beta
"proxy": {
  "data": {
    "result": false
  }
}

High-Activity Device

High-Activity Device searches for spikes in traffic connected to a single visitorID. It computes the amount of visits in the past 24 hours for each visitorID every five minutes and reports data.result as true if the number of visits for the past 24 hours surpasses a threshold.

High-Activity Device Threshold

The threshold is calculated for each customer separately and is determined through a normal traffic distribution. If the returned visitorID does more requests than 98% of other daily visitors, the High-Activity Smart Signal returns a positive result. If the traffic doesn't pass the threshold, data.result returns false and dailyRequests field isn't provided.

"highActivity": {
  "data": {
    "result": true,
    "dailyRequests": 42
  }
}

"highActivity": {
  "data": {
    "result": false
  }
}

Browser Smart Signals

The Smart Signals listed below apply only to browsers.

Browser Bot Detection

Get information about good and bad bots, allowing you to block or filter them from your regular traffic and stop automated abuse attempts.

The bot.result field contains one of notDetected, bad or good values where

• notDetected means that we haven't detected a bot and the payload should belong to a regular visitor
• good indicates that the bot is a well-known web crawler or other search engine bot
• bad is an automated tool that doesn't have legitimate uses and assumes fraudulent activity

"botd": {
  "data": {
    "bot": {
      "result": "bad",
      "type": "headless"
    },
    "url": "https://example.com/",
    "ip": "193.165.141.254",
    "time": "2024-04-12T09:29:59.588Z",
    "userAgent": "Headless",
    "requestId": "1712914199539.K1EXmu"
  }
}

"botd": {
  "data": {
    "bot": {
      "result": "notDetected"
    },
    "url": "https://example.com/",
    "ip": "94.142.239.124",
    "time": "2023-08-29T21:48:17.351Z",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36",
    "requestId": "1693345697334.YKOdT5"
  }
}

Browser Incognito Detection

Incognito flag detects whether incognito or private modes are being used by the visitor to access the customer's website.

Most browsers have an option called Incognito mode (Chrome) or Private mode (Safari, Firefox) that disables some functionality and makes the general browser storage more ephemeral. Normal browser tabs save additional information like cookies and local storage content in a way that ensures that the information is available to the website even after the browser window is closed and re-opened. Incognito mode makes sure that there are no such traces once a window gets closed.

Since the most basic fingerprinting technique could be storing a cookie in the visitor's browser, the incognito mode can be used to circumvent this simple mechanism, making sure that the returning visitor is not correctly re-identified through cookies and other information stored in the browser. This might be interpreted as an attempt to pose as a completely new identity. It might also be considered to be the most basic mechanism of browser tampering.

The flag is an interesting data point in fraud scenarios, especially in use cases where applying promotional coupons, redeeming bonuses or voting should be limited to once per user.

"incognito": {
  "data": {
    "result": true
  }
}

"incognito": {
  "data": {
    "result": false
  }
}

These browsers are supported:

• Safari (macOS / iOS)
• Chrome (Windows / macOS / iOS / Android / Linux)
• Samsung Browser (Android)
• Firefox (Windows / macOS / iOS / Android / Linux)
• Edge (Windows / macOS / iOS / Android)
• Brave (Windows / macOS / iOS / Android / Linux)

🚧

HTML iframes limitation

Incognito detection can give a false result when JS agent runs in an iframe. Make sure JS agent runs outside iframes to get the accurate result.

VPN Detection for browsers

Fingerprint's VPN detection is capable of detecting whether the user is in a different timezone compared to their originating IP address indicated by the timezoneMismatch flag. It can also provide information about whether an IP address is associated with one of the public VPN providers, indicated by the publicVPN flag, or anonymizing services, indicated by the relay flag . On top of that, we detect whether the OS of the client matches the OS of the network traffic we see, represented in the osMismatch flag.

If either of those detection methods return positive results, we return the final result as true.

"vpn": {
  "data": {
    "result": true,
    "confidence": "high",
    "originTimezone": "Europe/Prague",
    "originCountry": "unknown" // Not yet supported for browsers
    "methods": {
      "timezoneMismatch": true,
      "publicVPN": true,
      "auxiliaryMobile": false, // Irrelevant for browsers, mobile SDKs only
      "osMismatch": true,
      "relay": true
    }
  }
}

"vpn": {
  "data": {
    "result": false,
    "confidence": "high",
    "originTimezone": "Europe/Prague",
    "originCountry": "unknown" // Not yet supported for browsers
    "methods": {
      "timezoneMismatch": false,
      "publicVPN": false,
      "auxiliaryMobile": false, // Irrelevant for browsers, mobile SDKs only
      "osMismatch": false,
      "relay": false
    }
  }
}

result

• true if we detect a VPN through timezoneMismatch, publicVPN, relayor osMismatch methods. The field can be used as a standalone flag for VPN detection. Alternatively, fields in the methods section (documented below) can be used in specific use-cases to improve the granularity of the detection
• false if none of the methods below returned a positive result

confidence

The confidence level indicates how certain Fingerprint is that the current request is originating from a VPN. It is conveyed as a string with three possible values: high, medium, or low.

This confidence level is determined by evaluating multiple factors, such as publicVPN, timezoneMismatch, osMismatch, and other relevant methods.

In case of result: true

• High confidence: Clear, strong signals suggest the user is connected via a VPN.
• Medium confidence: Some signals point to possible VPN usage, including cases where a significant difference between the device's original timezone and the IP timezone is detected. The evidence is not definitive.
• Low confidence: Mainly due to a minor difference between the device's original timezone and the IP timezone. This could suggest scenarios other than VPN usage, such as when the network provider is registered in a different timezone or routes traffic through servers in another location.

In case of result: false

• High confidence: Strong signals suggest the user is not using a VPN.
• Medium confidence: Partial signals have been captured, but the evidence is not definitive.

originTimezone

This field exposes the IANA timezone that is available through the system settings. Since the presence of a VPN does not affect the value of this field, it can be used as a true timezone of origin (physical location) of the user.

• Example: originTimezone: "Europe/Prague"

originCountry

This field is populated only when the request comes from our iOS and Android native SDKs and is always set to "unknown" for browsers. See the detailed description in VPN Detection for mobile devices .

methods

More granular VPN detection methods that contribute to the final VPN detection result.

timezoneMismatch

• true when we detect that the geolocated IP address of the device does not match originTimezone read from the system settings
• false when originTimezone matches the location of the IP address from which we receive the traffic

The originTimezone includes a country-specific reference like "Europe/Prague". The timezoneMismatch will be true even if a visitor in Prague uses a Berlin VPN server, despite both countries being in the same GMT+2 UTC offset. For most use cases, timezoneMismatch functions well as an indicator of country mismatch between the browser and the IP address.

publicVPN

Detects whether the IP address of the event matches any publicly known VPN providers like NordVPN, Surfshark, ExpressVPN, ProtonVPN and others.

• true when our database of public VPN provider IP addresses contains the IP address of the event
• false if we did not find a match in our public VPN provider database

osMismatch

Compares the network signature of the request we have received through our proprietary algorithm and searches our internal database to determine whether the signature matches the OS (operating system) of the client.

• true if the network signature of the request we receive does not match the signature of the OS of the client
• false
  • if the network signature of the request we receive matches the signature of the OS of the client
  • if we fail to capture the OS information through our detection algorithm (happens in 10-15% cases)

The method is currently very accurate for Windows devices but might be less accurate for other OS combinations. We recommend using this flag to lower the false positive rate of the timezoneMismatch method.

relay

Detects whether the IP address of the event matches anonymizing services, such as iCloud Private Relay.

auxiliaryMobile

This field is populated only when the request came from our iOS and Android native SDKs and is always set to false for browsers. See the detailed description in VPN Detection for mobile devices .

Browser Tamper Detection

There are very simple techniques to confuse less sophisticated fingerprinting algorithms through User Agent spoofing or by changing the output of selected signals collected from the browser, including the use of anti-detect browsers.

While our visitorID remains stable in those cases, tampering detection helps detect this behavior and flag visitors who have tried applying such techniques by comparing their browser signature to our statistical model and checking whether the visitor is using an anti-detect browser.

"tampering": {
  "data": {
    "result": true,
    "anomalyScore": 0,
    "antiDetectBrowser": true // indicates usage of antidetect browser
  }
}

"tampering": {
  "data": {
    "result": true,
    "anomalyScore": 0.97, // close to 1 = high level of confidence
    "antiDetectBrowser": false 
  }
}

"tampering": {
  "data": {
    "result": false,
    "anomalyScore": 0,
    "antiDetectBrowser": false
  }
}

result

• true if tampering is identified based on an anomalyScore or antiDetectBrowser signal. The field can be used as a standalone flag for tampering. Alternatively, the other checks (documented below) can be used in specific use cases to improve the granularity of the detection
• false if none of the checks below indicate signs of tampering.

anomalyScore

The output of this model is captured as anomalyScore, a number indicating how improbable is the signature of the visitor's browser. Values close to 1 signify highly anomalous browsers and we consider anything above the threshold of 0.5 to be actionable (the result field conveniently captures that fact).

antiDetectBrowser

Detects the usage of anti-detect browsers, such as Incogniton.

Virtual Machine Detection

Detects if the browser is running inside a virtualization software like VirtualBox by examining the browser configuration.

"virtualMachine": {
  "data": {
    "result": true
  }
}

"virtualMachine": {
  "data": {
    "result": false
  }
}

Privacy-Focused Settings

Firefox, Brave, and other privacy-focused browsers actively fight fingerprinting and expose user settings that have the ability to randomize and obfuscate signal output. The Privacy-Focused Settings Smart Signal detects if those settings are enabled and reports it.

"privacySettings": {
  "data": {
    "result": true
  }
}

"privacySettings": {
  "data": {
    "result": false
  }
}

Developer Tools Detection

Detect if developer tools are manually opened in Chrome or Firefox browsers.

Note: Data required for Developer Tools detection are collected when the JavaScript agent loads, not when the user is identified. This can result in false negatives if the visitor opens Developer Tools only after loading the page.

"developerTools": {
  "data": {
    "result": true
  }
}

"developerTools": {
  "data": {
    "result": false
  }
}

Remote Control Tools Detection

To detect the usage of remote control tools by checking if the request originated from a device being remotely controlled or remotely controlling another device, you must first enable this feature. Data will not be collected unless the remoteControlDetection flag is set to true. Once enabled, please contact our support team to activate the result exposure.

The currently supported remote tools are:

• AnyDesk: Supported on Windows, macOS, and Android (Webview)
• TeamViewer and RDP: Supported on Windows

"remoteControl": {
  "data": {
    "result": true
  }
}

"remoteControl": {
  "data": {
    "result": false
  }
}

Raw Device Attributes

Raw Device Attributes expose additional data points we normally collect through our JavaScript agent. This Smart signal is only available for web browsers.

🚧

Format Stability

Raw Device Attributes contents can change at any time in the future (includes complete scoped field removal) and we advise against setting dependencies on concrete field names inside of the data field.

"rawDeviceAttributes": {
  "data": {
    "<field_name>": {
      "value": 127
    }
}

Smart Signals for mobile devices

The smart signals listed in this section apply only to mobile devices. They provide valuable intelligence about the integrity of the device and the app. These smart signals are available as part of our Pro Plus and Enterprise plans. If you are interested in one or more of these signals, then please contact our support team to enable them for you.

When your app is integrated with Fingerprint (using either our native mobile SDKs or our multi-platform SDKs), you will receive these signals as part of our Server API and/or Webhooks responses.

Android Emulator Detection

Prevent spam and protect against nefarious Android emulator farms by ensuring the request is coming from a physical device. To detect emulators, several additional device attributes have to be collected and this increases the time to get a visitorId. The latency can be anywhere between 300 and 1500ms.

"emulator": {
  "data": {
    "result": false
  }
}

Cloned App Detection

Identify if a request is coming from a cloned application. Making multiple clones of an app on the same device can be used to abuse promotions and get around app restrictions. (Android only)

"clonedApp": {
  "data": {
    "result": false
  }
}

Factory Reset Detection

Resetting a mobile device to default factory settings has been a common technique that fraudsters use to evade fraud detection mechanisms. When a factory reset is performed, it can

• Disguise the identity of the mobile device
• Be used to abuse promotional offers
• Prevent the mobile device from being blocked for fraudulent activity

The Factory Reset Smart Signal will indicate when the mobile device was most recently factory reset. You can use this information in your fraud detection mechanisms to flag a mobile device as suspicious.

As an example, for a mobile device that was factory reset on July 19, 2023, at 6 AM EST, the response will be:

"factoryReset": {
  "data": {
    // The time when the mobile device was factory reset in UTC
    "time": "2023-07-19T011:00:00Z",
    // The UTC 'time' represented as Unix epoch time
    "timestamp": 1689445704
  }
}

What is the response for devices that were never factory reset?

• For Android devices that were never factory reset, the time and timestamp fields in the response will correspond to when the device was activated.

• For iOS devices that were never factory reset, the time and timestamp fields will correspond to epoch:

  JSON

   "factoryReset": {
     "data": {
       "time": "1970-01-01T00:00:00Z",
       "timestamp": 0
   }
  }

In what other scenarios can a timestamp correspond to epoch?

• The iOS device that initiated the request is not a physical device but an iOS simulator. (Conversely, a factory reset can be detected for Android emulators).
• Your iOS app does not use Fingerprint Identification SDK v2.3.0 or higher. The ability to detect factory reset was introduced only in v2.3.0.
• Your Android app uses an incompatible version of Fingerprint Identification SDK
  • <v2.3.0: The ability to detect factory reset was introduced only in v2.3.0.
  • v2.3.0 ≥ SDK < 2.3.4: Due to lazy signal collection, more than one request must be initiated from the same device for a factory reset to be detected. If you would like to use one of these versions in your app, you first need to contact our support team to enable factory reset detection for your account. (Since the first request from a fraudulent device is the most critical request to detect fraud, we made improvements in v2.3.4 that allowed us to detect a factory reset during the first request itself.)

Frida Detection

In simple terms, app hooking is a process where the behavior of a mobile app is changed by intercepting the app at runtime. Frida is a dynamic instrumentation toolkit that tech-savvy fraudsters can use to spoof an app at runtime and change its behavior. With this smart signal, you will know if Frida is being used to dynamically instrument the app.

"frida": {
  "data": {
    "result": false
  }
}

Geolocation Spoofing Detection

Fraudsters spoof the location of their mobile devices to fool fraud detection systems. With this smart signal, you will know if the location of the mobile device has been spoofed or not. For iOS only, this signal requires the host app to be granted Location Permission.

"locationSpoofing": {
  "data": {
    "result": false
  }
}

Jailbroken Device Detection

An iPhone or an iPad is labeled jailbroken when unauthorized modifications are made to the underlying operating system (iOS). Jailbreaking weakens a device’s built-in security features and makes it easy to steal sensitive information stored on the device. See Unauthorized modification of iOS for more information.

Fraudsters employ phishing mechanisms to trick users into installing jailbreak software on their devices and then take control of their devices. Your app (e.g. banking, e-commerce, etc) will not be able to distinguish the transactions made using jailbroken devices from those made using genuine devices. Honoring these fraudulent transactions will lead to financial losses (caused by chargeback expenses, account takeover, etc) and loss of trust among your customers.

The Jailbroken Smart Signal will help you detect if your app is being used from an iPhone/iPad that has been jailbroken and enable you to proactively act upon it.

"jailbroken": {
  "data": {
    "result": false
  }
}

MitM Attack Detection

Man-in-the-Middle (MitM) attacks occur when a fraudster intercepts the communication between two parties with the intention of

• Gaining access to sensitive information.
• Modifying the information to their advantage.
• Block the requests to/from the intended parties.

These attacks can result in service disruptions for an organization, diminishing customer trust, damaging reputation, and causing financial losses.

The MitM Attacks Smart Signal will help you detect if requests made to Fingerprint servers are intercepted and potentially modified. You can use this information to identify spoofed requests/responses and take additional precautionary steps.

"mitmAttack": {
  "data": {
    "result": false
  }
}

Rooted Device Detection

Ensure a safe Android mobile application environment by detecting rooted devices.

"rootApps": {
  "data": {
    "result": false
  }
}

Tampered Request Detection for mobile apps

Promotional offers are often exploited by creating multiple accounts. Device identification enables businesses to determine if the same mobile device was used to create multiple accounts. One technique fraudsters employ to trick device identification is to modify the request sent to our servers.

When your app requests a visitor ID for the device, Fingerprint collects several properties from the device and sends it to our servers. The properties collected from the device are used to generate the visitor ID and deduce other Smart Signals. However, if the properties within the request are modified beyond recognition, then

• A new visitor ID could be generated for an already-seen device
• All the intended Smart Signals may not be flagged.

The Tampered Request Detection Smart Signal detects anomalies in the properties received with the request. Thus, it enables you to identify tampered requests and take corresponding mitigation measures.

"tampering": {
  "data": {
    "result": true,
    "anomalyScore": 1, 
    "antiDetectBrowser": false
  }
}

result

Indicates if an identification request from an Android SDK has been tampered with.

• true - If the request contains anomalous device attributes that could not have been legitimately produced by Android SDK (see anomalyScore).
• false - If the request is considered genuine or if it originated from the iOS SDK.

anomalyScore

When the request contains anomalous device attributes, this value is 1. Otherwise, it is 0.

antiDetectBrowser

This field does not apply to requests originating from mobile SDKs. It is always false.

VPN Detection for mobile devices

VPN apps for mobile devices are popular with both legit users and fraudsters. These VPN apps

• Protect their users’ privacy by encrypting all their traffic
• Allow their users to remain anonymous by giving them the ability to hide their real location

The VPN Detection Smart Signal for mobile devices will help you detect if your app is being used by a mobile device with an active VPN connection.

"vpn": {
  "data": {
    "result": false,
    "confidence": "high",
    "originTimezone": "Europe/Berlin",
    "originCountry": "DE" // country code string in the ISO 3166 format
    "methods": {
      "timezoneMismatch": false,
      "publicVPN": false,
      "auxiliaryMobile": True,
      "osMismatch": false, // always false, irrelevant for native SDKs
      "relay": false
    }
}

result

For mobile devices, result is true when either of the four listed methods is true:

• timezoneMismatch - true when the device is in a different timezone compared to the timezone of the originating IP address.
• publicVPN - true when the IP address matches one of the known IP addresses that belong to public VPN providers.
• auxiliaryMobile - true when other proprietary detection methods indicate the presence of a VPN.
• osMismatch - always false when using mobile SDKs.
• relay- true then the IP address of the event matches anonymizing services, such as iCloud Private Relay.

confidence

The confidence level indicates how certain Fingerprint is that the current request is originating from a VPN. This confidence level is determined by evaluating multiple factors, such as publicVPN, timezoneMismatch, auxiliaryMobile, and other relevant methods.

To learn more about the possible values and how they are determined, see confidence.

originTimezone

This field indicates the IANA timezone that is currently set for the mobile device. In situations where a VPN is enabled, this timezone can be different from the timezone associated with the IP address.

The originTimezone usually includes a country-specific reference like "Europe/Prague". The timezoneMismatch will be true even if a mobile user in Prague uses a Berlin VPN server, despite both countries being in the same GMT+2 UTC offset. For most use cases, timezoneMismatch functions well as an indicator of country mismatch between the mobile device and the IP address.

This field is supported for both Android and iOS devices.

originCountry

This field indicates the country in which the mobile device is physically located at the time of request. The country is represented in ISO 3166 format. It does not require Location Permissions to be enabled for your app.

This field can be very useful in situations where an active VPN can mask the true location of the device.

Android devices

• This field is supported only in Android SDK v2.4.0 and higher. For lower versions of the SDK, the value is set to unknown.
• If the request is from an emulator, irrespective of the SDK version used, the value is set to unknown.

iOS devices

• originCountry is not yet supported and the value is set to unknown.