Docs · Reference · Signals
All 267 signals
Every datum we collect along with the score weight it carries when it fires. Weights stack so they are capped at 100 and the final score is the sum.
Server signals are computed on our side from the connection or threat intel tables. Client signals come from the browser SDK. Derived signals are computed from comparing the others.
Network · S001 to S059
IP, TLS, HTTP, WebRTC. (59 signals)
| ID | Name | Description | Weight | Side |
|---|---|---|---|---|
| S001 | ip.v4 | IPv4 of the connection | — | server |
| S002 | ip.v6 | IPv6 of the connection | — | server |
| S003 | ip.subnet_24 | /24 block of IPv4 | +25 | derived |
| S004 | ip.subnet_48 | /48 block of IPv6 | +25 | derived |
| S005 | ip.asn | Autonomous System Number | — | server |
| S006 | ip.asn_org | ASN organization name | — | server |
| S007 | ip.country | ISO 3166-1 country | — | server |
| S008 | ip.region | State/province | — | server |
| S009 | ip.city | City | — | server |
| S010 | ip.lat_long | City centroid coordinates | — | server |
| S011 | ip.timezone | IANA timezone of IP location | — | server |
| S012 | ip.hosting_type | Category (residential/datacenter/vpn/proxy/mobile/...) | — | server |
| S013 | ip.is_vpn | Known VPN exit | +25 | server |
| S014 | ip.is_tor | Tor exit node | +80 | server |
| S015 | ip.is_proxy | Known proxy | +30 | server |
| S016 | ip.is_residential_proxy | Residential proxy network | +50 | server |
| S017 | ip.is_mobile_carrier | Mobile carrier IP | +-10 | server |
| S018 | ip.is_datacenter | Datacenter IP | +30 | server |
| S019 | ip.is_cloud_provider | Major cloud provider IP | +35 | server |
| S020 | ip.reputation_score | Our reputation score 0–100 | +40 | server |
| S021 | ip.first_seen_in_system | First time we ever saw this IP | — | derived |
| S022 | ip.last_seen_in_system | Most recent time we saw this IP | — | derived |
| S023 | ip.velocity_1h | Checks from this IP in 1h | +20 | derived |
| S024 | ip.velocity_24h | Checks from this IP in 24h | +25 | derived |
| S025 | ip.velocity_7d | Checks from this IP in 7d | +15 | derived |
| S026 | subnet.velocity_24h | Checks from /24 in 24h | +20 | derived |
| S027 | asn.velocity_24h | Checks from ASN in 24h | +25 | derived |
| S028 | ip.concurrent_sessions | Active sessions from this IP | +15 | derived |
| S029 | ip.rdns | Reverse DNS PTR | — | server |
| S030 | ip.rdns_leaks_datacenter | rDNS leaks datacenter | +20 | derived |
| S031 | ip.timezone_vs_browser_tz_mismatch | IP TZ != browser TZ | +20 | derived |
| S032 | ip.country_vs_browser_locale_mismatch | Browser language unusual for IP country | +10 | derived |
| S033 | tls.ja3 | JA3 hash from ClientHello | — | server |
| S034 | tls.ja3_text | JA3 raw text | — | server |
| S035 | tls.ja4 | JA4 fingerprint | — | server |
| S036 | tls.ja4_text | JA4 raw text | — | server |
| S037 | tls.has_grease | TLS GREASE extension present | +30 | server |
| S038 | tls.ja4_known_bot | JA4 matches known bot | +60 | server |
| S039 | tls.ja4_matches_claimed_ua | JA4 consistent with UA claim | +30 | derived |
| S040 | http.http2_fingerprint | HTTP/2 SETTINGS+priority fingerprint | — | server |
| S041 | http.http2_fingerprint_mismatch | HTTP/2 fingerprint inconsistent with claimed browser | +30 | derived |
| S042 | http.header_casing_anomaly | Header casing inconsistent with browser | +15 | server |
| S043 | http.sec_fetch_missing | Sec-Fetch-* missing on modern browser claim | +10 | server |
| S044 | http.user_agent | User-Agent header | — | server |
| S045 | http.accept_language | Accept-Language header | — | server |
| S046 | webrtc.public_ip_mismatch | WebRTC IP != connection IP | +25 | derived |
| S047 | dns.over_https_used | Client appears to use DoH | — | derived |
| S048 | mtu.inferred | Inferred MTU | — | server |
| S049 | tcp.window_size | TCP window size | — | server |
| S050 | tcp.ttl_estimate | Initial TTL estimate | — | server |
| S051 | tcp.fingerprint_p0f | p0f-style passive OS fingerprint | — | server |
| S052 | tls.alpn | ALPN list | — | server |
| S053 | tls.sni | SNI value | — | server |
| S054 | tls.cipher_chosen | Cipher suite selected | — | server |
| S055 | tls.version | Negotiated TLS version | — | server |
| S056 | tls.session_resumed | TLS session resumed | — | server |
| S057 | http.referer | Referer header (server-observed) | — | server |
| S058 | http.origin | Origin header | — | server |
| S059 | connect.latency_ms | TLS handshake latency | — | server |
Browser or device · S060 to S172
Navigator, screen, fonts, canvas, WebGL, audio. (113 signals)
| ID | Name | Description | Weight | Side |
|---|---|---|---|---|
| S060 | nav.user_agent | navigator.userAgent | — | client |
| S061 | nav.user_agent_data | UA-CH high-entropy values | — | client |
| S062 | nav.platform | navigator.platform | — | client |
| S063 | nav.languages | navigator.languages | — | client |
| S064 | nav.language | navigator.language | — | client |
| S065 | nav.hardware_concurrency | navigator.hardwareConcurrency (CPU cores) | — | client |
| S066 | nav.device_memory | navigator.deviceMemory (GB bucket) | — | client |
| S067 | nav.max_touch_points | Touch points supported | — | client |
| S068 | nav.do_not_track | DNT | — | client |
| S069 | nav.cookie_enabled | navigator.cookieEnabled | — | client |
| S070 | nav.online | navigator.onLine | — | client |
| S071 | nav.pdf_viewer_enabled | navigator.pdfViewerEnabled | — | client |
| S072 | nav.plugins_count | Number of navigator.plugins entries | — | client |
| S073 | nav.plugins_hash | Hash of plugins list | — | client |
| S074 | nav.mime_types_hash | Hash of navigator.mimeTypes | — | client |
| S075 | screen.width | screen.width | — | client |
| S076 | screen.height | screen.height | — | client |
| S077 | screen.avail_width | screen.availWidth | — | client |
| S078 | screen.avail_height | screen.availHeight | — | client |
| S079 | screen.color_depth | screen.colorDepth | — | client |
| S080 | screen.pixel_depth | screen.pixelDepth | — | client |
| S081 | screen.pixel_ratio | window.devicePixelRatio | — | client |
| S082 | screen.orientation | screen.orientation.type | — | client |
| S083 | screen.viewport_width | innerWidth | — | client |
| S084 | screen.viewport_height | innerHeight | — | client |
| S085 | locale.timezone | Intl.DateTimeFormat resolvedOptions.timeZone | — | client |
| S086 | locale.timezone_offset | Date getTimezoneOffset | — | client |
| S087 | locale.number_format | Intl.NumberFormat resolvedOptions | — | client |
| S088 | locale.date_format | Intl.DateTimeFormat resolvedOptions | — | client |
| S089 | canvas.hash | Canvas 2D rendering hash | — | client |
| S090 | canvas.emoji_hash | Canvas emoji rendering hash | — | client |
| S091 | canvas.text_hash | Canvas text rendering hash | — | client |
| S092 | webgl.vendor | WebGL VENDOR | — | client |
| S093 | webgl.renderer | WebGL RENDERER | — | client |
| S094 | webgl.unmasked_vendor | WEBGL_debug_renderer_info unmasked vendor | — | client |
| S095 | webgl.unmasked_renderer | WEBGL_debug_renderer_info unmasked renderer (GPU) | — | client |
| S096 | webgl.params_hash | Hash of MAX_TEXTURE_SIZE, MAX_VIEWPORT_DIMS, etc. | — | client |
| S097 | webgl.extensions_hash | Hash of supported WebGL extensions | — | client |
| S098 | webgl.shader_precision_hash | Hash of shader precision formats | — | client |
| S099 | webgl2.supported | WebGL2 context available | — | client |
| S100 | audio.fingerprint | OfflineAudioContext rendering hash | — | client |
| S101 | audio.sample_rate | AudioContext sampleRate | — | client |
| S102 | audio.channel_count_max | destination.maxChannelCount | — | client |
| S103 | audio.compressor_node_hash | DynamicsCompressorNode output hash | — | client |
| S104 | fonts.installed | List of detected installed fonts | — | client |
| S105 | fonts.installed_hash | Hash of installed fonts list | — | client |
| S106 | fonts.installed_count | Number of installed fonts detected | — | client |
| S107 | media.speech_voices | speechSynthesis.getVoices() | — | client |
| S108 | media.speech_voices_hash | Hash of speech voices | — | client |
| S109 | media.media_capabilities_hash | Hash of MediaCapabilities decodingInfo results | — | client |
| S110 | media.video_inputs | Number of video inputs (no labels) | — | client |
| S111 | media.audio_inputs | Number of audio inputs (no labels) | — | client |
| S112 | media.audio_outputs | Number of audio outputs | — | client |
| S113 | perms.notifications | Permission state | — | client |
| S114 | perms.geolocation | Permission state | — | client |
| S115 | perms.camera | Permission state | — | client |
| S116 | perms.microphone | Permission state | — | client |
| S117 | perms.midi | Permission state | — | client |
| S118 | webrtc.public_ips | WebRTC discovered public IPs (server-reflexive) | — | client |
| S119 | webrtc.local_ips | WebRTC discovered local IPs | — | client |
| S120 | math.fingerprint | Hash of Math.* edge cases (asinh, etc.) | — | client |
| S121 | timing.performance_now_resolution | performance.now() effective resolution | — | client |
| S122 | timing.date_resolution | Date.now() resolution | — | client |
| S123 | storage.persisted | navigator.storage.persisted() | — | client |
| S124 | storage.quota_gb | navigator.storage.estimate().quota in GB | — | client |
| S125 | storage.session_supported | sessionStorage available | — | client |
| S126 | storage.local_supported | localStorage available | — | client |
| S127 | storage.idb_supported | IndexedDB available | — | client |
| S128 | feature.service_worker | navigator.serviceWorker present | — | client |
| S129 | feature.push_manager | PushManager available | — | client |
| S130 | feature.payment_request | PaymentRequest available | — | client |
| S131 | feature.credential_management | navigator.credentials available | — | client |
| S132 | feature.bluetooth | navigator.bluetooth available | — | client |
| S133 | feature.usb | navigator.usb available | — | client |
| S134 | feature.hid | navigator.hid available | — | client |
| S135 | feature.serial | navigator.serial available | — | client |
| S136 | feature.share | navigator.share available | — | client |
| S137 | feature.locks | navigator.locks available | — | client |
| S138 | feature.wake_lock | navigator.wakeLock available | — | client |
| S139 | feature.gamepad | getGamepads available | — | client |
| S140 | feature.eye_dropper | window.EyeDropper available | — | client |
| S141 | feature.shape_detection | BarcodeDetector etc. | — | client |
| S142 | feature.web_assembly | WebAssembly support | — | client |
| S143 | feature.web_workers | Worker support | — | client |
| S144 | feature.shared_workers | SharedWorker support | — | client |
| S145 | feature.web_rtc | RTCPeerConnection support | — | client |
| S146 | css.media_pointer_coarse | matchMedia pointer: coarse | — | client |
| S147 | css.media_pointer_fine | matchMedia pointer: fine | — | client |
| S148 | css.media_hover_hover | matchMedia hover: hover | — | client |
| S149 | css.media_any_pointer | matchMedia any-pointer | — | client |
| S150 | css.media_prefers_dark | matchMedia prefers-color-scheme: dark | — | client |
| S151 | css.media_prefers_contrast | matchMedia prefers-contrast | — | client |
| S152 | css.media_prefers_reduced_motion | matchMedia prefers-reduced-motion | — | client |
| S153 | css.forced_colors | matchMedia forced-colors | — | client |
| S154 | css.display_mode | matchMedia display-mode: standalone | — | client |
| S155 | window.outer_dimensions | outerWidth/outerHeight | — | client |
| S156 | window.screen_x | screenX/screenY | — | client |
| S157 | window.dpi_inferred | Inferred DPI from devicePixelRatio | — | client |
| S158 | battery.charging | Battery API charging state | — | client |
| S159 | battery.level | Battery API level | — | client |
| S160 | connection.effective_type | navigator.connection.effectiveType | — | client |
| S161 | connection.downlink | navigator.connection.downlink | — | client |
| S162 | connection.rtt | navigator.connection.rtt | — | client |
| S163 | connection.save_data | navigator.connection.saveData | — | client |
| S164 | connection.type | navigator.connection.type | — | client |
| S165 | intl.locale | Intl.Locale resolved values | — | client |
| S166 | intl.collation | Collation fingerprint via sort order | — | client |
| S167 | intl.currency_format | Currency format sample | — | client |
| S168 | console.fingerprint | console-specific quirks | — | client |
| S169 | error.stack_format | Error stack format fingerprint | — | client |
| S170 | engine.v8_features | V8-specific feature detection | — | client |
| S171 | engine.spidermonkey_features | SpiderMonkey-specific feature detection | — | client |
| S172 | engine.webkit_features | WebKit-specific feature detection | — | client |
Anti evasion · S173 to S199
Bot frameworks, headless tells, spoof detection. (27 signals)
| ID | Name | Description | Weight | Side |
|---|---|---|---|---|
| S173 | evasion.webdriver_flag | navigator.webdriver === true | +90 | derived |
| S174 | evasion.puppeteer_signature | Puppeteer signatures present | +80 | derived |
| S175 | evasion.playwright_signature | Playwright signatures present | +80 | derived |
| S176 | evasion.selenium_signature | Selenium signatures present | +80 | derived |
| S177 | evasion.is_headless | Headless indicators (HeadlessChrome UA, missing plugins, etc.) | +70 | derived |
| S178 | evasion.stealth_plugin | Stealth plugin inconsistencies | +50 | derived |
| S179 | evasion.canvas_noise | Canvas fingerprint noise | +30 | derived |
| S180 | evasion.audio_noise | Audio fingerprint noise | +30 | derived |
| S181 | evasion.webgl_spoofed | WebGL renderer inconsistent with platform | +25 | derived |
| S182 | evasion.tor_browser | Tor Browser detected | +70 | derived |
| S183 | consistency.ua_platform_mismatch | UA platform conflicts with navigator.platform | +60 | derived |
| S184 | consistency.ua_webgl_mismatch | UA OS conflicts with WebGL renderer | +60 | derived |
| S185 | consistency.ua_client_hints_mismatch | UA conflicts with Client Hints | +40 | derived |
| S186 | consistency.touch_platform_mismatch | Touch capability conflicts with platform | +70 | derived |
| S187 | consistency.mobile_screen_mismatch | Mobile flag with desktop screen size | +50 | derived |
| S188 | consistency.tz_ip_mismatch | Browser timezone differs from IP location | +20 | derived |
| S189 | consistency.locale_ip_mismatch | Browser language unusual for IP country | +10 | derived |
| S190 | consistency.browser_version_stale | Browser version > 6 months old | +15 | derived |
| S191 | consistency.plugins_browser_mismatch | No plugins on claimed modern Chrome | +30 | derived |
| S192 | consistency.languages_mismatch | navigator.language not in navigator.languages | +40 | derived |
| S193 | consistency.notification_inconsistent | Notification API state inconsistent | +30 | derived |
| S194 | evasion.window_chrome_missing | window.chrome missing on Chrome UA | — | derived |
| S195 | evasion.permissions_query_lies | navigator.permissions.query returns inconsistent result | — | derived |
| S196 | evasion.iframe_chrome_lies | iframe contentWindow.chrome inconsistent | — | derived |
| S197 | evasion.toString_tampered | Function.toString returns suspicious source | — | derived |
| S198 | evasion.battery_unsupported_in_modern_chrome | Battery API state suggests masking | — | derived |
| S199 | evasion.plugin_array_constructor_check | plugins constructor name tampered | — | derived |
Behavioral · S200 to S221
Mouse, keystrokes, paste, autofill. (22 signals)
| ID | Name | Description | Weight | Side |
|---|---|---|---|---|
| S200 | behavior.mouse_event_count | Number of mouse events observed before submit | — | client |
| S201 | behavior.keystroke_count | Number of keystrokes | — | client |
| S202 | behavior.touch_event_count | Touch events observed | — | client |
| S203 | behavior.focus_blur_count | Focus/blur events | — | client |
| S204 | behavior.scroll_distance | Cumulative scroll distance | — | client |
| S205 | behavior.time_on_page_ms | Time on page before submit | — | client |
| S206 | behavior.copy_paste_count | Number of paste events | — | client |
| S207 | behavior.paste_into_email | Email field filled by paste | — | client |
| S208 | behavior.paste_into_password | Password field filled by paste | — | client |
| S209 | behavior.tab_switches | visibilitychange events with hidden | — | client |
| S210 | behavior.visibility_changes | visibilitychange events count | — | client |
| S211 | behavior.no_human_input | No mouse movement and no keystroke variance | +60 | derived |
| S212 | behavior.keystroke_too_uniform | Keystroke timing too uniform | +40 | derived |
| S213 | behavior.mouse_too_straight | Mouse paths too straight | +30 | derived |
| S214 | behavior.typing_speed_wpm | Estimated typing speed | — | derived |
| S215 | behavior.first_input_delay_ms | Delay from page load to first user input | — | client |
| S216 | behavior.form_fill_order | Order in which form fields were filled | — | client |
| S217 | behavior.form_fill_speed_ms | Time taken to fill the form | — | client |
| S218 | behavior.autofill_used | Browser autofill detected | — | client |
| S219 | behavior.devtools_open | DevTools detected as open | — | client |
| S220 | behavior.mouse_acceleration_variance | Variance in mouse acceleration | — | derived |
| S221 | behavior.click_timing_variance | Variance in click timing | — | derived |
Identity · S222 to S260
Email, phone, card. (39 signals)
| ID | Name | Description | Weight | Side |
|---|---|---|---|---|
| S222 | email.raw | Email as provided | — | server |
| S223 | email.normalized | Lowercased, trimmed | — | server |
| S224 | email.canonical | After +alias stripping, Gmail dot-collapse | — | derived |
| S225 | email.local | Local part | — | server |
| S226 | email.domain | Domain part | — | server |
| S227 | email.canonical_match | Same canonical email as previous trial | +60 | derived |
| S228 | email.is_disposable | Disposable email provider | +30 | derived |
| S229 | email.is_relay | Email relay/forwarding service (Apple, SimpleLogin, etc.) | +10 | derived |
| S230 | email.is_freemail | Free webmail provider | — | derived |
| S231 | email.is_corporate | Likely corporate email (non-freemail, has MX, > 1y old) | — | derived |
| S232 | email.is_role_based | Role-based local part (admin, info, ...) | +15 | derived |
| S233 | email.is_gibberish | Random-looking local part | +20 | derived |
| S234 | email.local_short | Local part length < 4 | +5 | derived |
| S235 | email.local_numeric_ratio | Numeric ratio > 0.5 | +5 | derived |
| S236 | email.domain_age_days | Days since WHOIS registration | — | server |
| S237 | email.domain_new | Domain age < 30 days | +25 | derived |
| S238 | email.mx_valid | Domain has MX records | +30 | server |
| S239 | email.mx_count | MX records returned | — | server |
| S240 | email.smtp_deliverable | SMTP RCPT TO check | +30 | server |
| S241 | email.catch_all_domain | Domain accepts any mailbox | +10 | server |
| S242 | email.plus_alias_count | Same canonical seen with multiple +aliases | +30 | derived |
| S243 | email.gmail_dot_variant_count | Same Gmail with dot variants | +35 | derived |
| S244 | phone.raw | Phone as provided | — | server |
| S245 | phone.e164 | E.164 normalized | — | derived |
| S246 | phone.country | Country from E.164 prefix | — | derived |
| S247 | phone.line_type | mobile / fixed_line / voip / ... | — | derived |
| S248 | phone.is_voip | VoIP number | +20 | derived |
| S249 | phone.is_toll_free | Toll-free number | +10 | derived |
| S250 | phone.canonical_match | Same phone as previous trial user | +50 | derived |
| S251 | phone.country_vs_ip_mismatch | Phone country differs from IP country | +10 | derived |
| S252 | phone.country_vs_email_mismatch | Phone country disagrees with email TLD country | +5 | derived |
| S253 | card.fp | Card fingerprint from PSP | — | server |
| S254 | card.fp_match | Same card as previous trial user | +70 | derived |
| S255 | card.bin | Card BIN (first 6–8) | — | server |
| S256 | card.is_prepaid | Prepaid card | +20 | derived |
| S257 | card.is_virtual_disposable | Privacy.com / Revolut Disposable / etc. | +35 | derived |
| S258 | card.country_vs_ip_mismatch | Card country differs from IP country | +10 | derived |
| S259 | card.country_vs_billing_mismatch | Card country differs from billing country | +15 | derived |
| S260 | card.avs_mismatch | AVS not full match | +10 | derived |
Composite IDs · S261 to S264
Derived SHA256 identifiers used for matching. (4 signals)
| ID | Name | Description | Weight | Side |
|---|---|---|---|---|
| S261 | composite.hardware_id | Hardware-level SHA-256 over canvas+WebGL+audio+CPU+RAM+screen+platform | +45 | derived |
| S262 | composite.browser_id | Browser-profile SHA-256 over UA+fonts+voices+locale+permissions | +30 | derived |
| S263 | composite.network_id | Network SHA-256 over ASN+subnet+JA4+HTTP2 | +25 | derived |
| S264 | composite.identity_id | Identity SHA-256 over email canonical+phone+card | +50 | derived |
Soft identifiers · S265 to S267
Cookie, localStorage, IndexedDB. (3 signals)
| ID | Name | Description | Weight | Side |
|---|---|---|---|---|
| S265 | soft.first_party_cookie | First-party visitor cookie (_tellr_visitor) | — | client |
| S266 | soft.local_storage_id | localStorage visitor ID (_tellr_v) | — | client |
| S267 | soft.idb_id | IndexedDB visitor ID (_tellr.v.id) | — | client |