Risk Signal Details

Named reason codes that explain the network and device risk scores for a session

The risk_signal_details object gives you concrete, named reason codes that explain why a session’s risk scores are elevated. It is returned as a sibling of risk_signals and risk_signal_scores inside the session object on POST /session/authenticate, POST /session/unauthenticated, and GET /session/{session_id}.

"risk_signal_details": {
  "network": [
    "true_country_mismatch",
    "ip_on_vpn_list",
    "ip_device_timezone_mismatch"
  ],
  "device": []
}

For a clean session the arrays are empty; for a risky session they contain only the reasons that contributed to risk. Signal presence is designed to be safe to write rules against — each signal appears only when there is affirmative evidence for it.

How signals relate to scores

Risk signals are consistent with the scores they explain: a session whose proxy and VPN scores read clean will never carry a proxy- or VPN-related signal, and a session whose device risk score reads clean will never carry a probe-based device signal. Some signals are deliberately independent of score levels because they are meaningful on their own: location-consistency signals such as true_country_mismatch and outside_expected_countries, the network registry signals (new_asn, leased_network, network_registry_location_mismatch, network_operator_changed, network_block_holder_mismatch), and the administrative device-brand signals chinese_sanctioned_device and chinese_device, which describe a factual property of the device rather than risk evidence and are designed to be combined with location or other conditions in rules.

As risk scores increase, sessions typically carry more corroborating signals: a moderately risky session usually shows one or two reasons, while a highly risky session shows several.

Network Signals

Network signals explain the proxy, vpn, and location-related scores. They describe evidence that the session’s network path or claimed location is not what it appears to be. The network registry signals (new_asn through network_block_holder_mismatch) describe the network the IP belongs to, from public internet-registry and routing records; they are refreshed nightly and appear regardless of the session’s proxy and VPN scores.

Risk Signal	Description
network_latency_anomaly	connection round-trip timing is anomalously high for the session’s region and connection type — the classic pattern of traffic tunneled through an intermediate server
network_fingerprint_anomaly	low-level network fingerprint does not look like the browser the session claims to be
network_device_os_mismatch	OS inferred from how the device builds its network packets disagrees with the OS the device claims — strong evidence of a proxy relaying traffic from a different machine
true_country_mismatch	the country Verisoul resolves as the user’s most likely true location differs from the raw IP country
ip_on_datacenter_list	IP is hosted in a known datacenter or cloud-hosting range rather than a residential or mobile network
ip_device_timezone_mismatch	device’s configured timezone is geographically far from the IP location
ip_device_lang_country_mismatch	device language implies a country inconsistent with the IP location (common benign variants like en-US abroad do not fire)
outside_expected_countries	an observed session country (IP or resolved true country) falls outside the account’s declared expected countries; fires only on definitive out-of-list evidence, and only for accounts that declared expected countries
ip_on_proxy_list	one or more IP intelligence sources flag the IP as a proxy; when both proxy and VPN list evidence exist, only the stronger of the two is emitted
true_ip_leak	a network probe observed an IP revealing a different network identity than the client IP — the user’s real address leaking through their proxy or VPN
ip_location_mismatch	two independent observations of the session’s IP address resolve to locations far apart — one leg of the connection went through a proxy or VPN while the other went direct
http1_connection	the connection to Verisoul stayed on HTTP/1.1 instead of HTTP/2 on a non-corporate network — modern browsers negotiate HTTP/2, and forcing HTTP/1.1 hides the timing measurements that reveal proxies
ip_on_vpn_list	one or more IP intelligence sources flag the IP as a VPN exit, or it matches a known VPN service; subject to the same either-or rule as ip_on_proxy_list
new_asn	the network (ASN) the IP belongs to was registered to its current holder within the last two years
leased_network	the network’s traffic sits on IP space that changed hands in the past year, and the address space it announces turns over month to month — the footprint of an IP-leasing operation
network_registry_location_mismatch	the network is registered with a different regional internet registry than the one serving the country its traffic comes from
network_operator_changed	the network’s registered name changed within the past year to one unrelated to the old name — often a change of operator, though a corporate rebrand to an unrelated name also qualifies
network_block_holder_mismatch	the IP’s /24 block is registered to one country but announced to the internet by a network registered to another
mobile_vpn_tunnel_detected	the device’s own network configuration shows an active VPN tunnel interface — VPN evidence observed on the device itself rather than from IP intelligence
mobile_proxy_configured	an HTTP proxy is configured in the device’s operating-system network settings

Device Signals

Device signals explain the device_risk score. They describe evidence that the device or browser is tampered with, automated, virtualized, or otherwise not a normal personal device.

Risk Signal	Description
browser_tampering_detected	browser internals appear modified — anti-detect tooling, failing integrity probes, or manipulated browser properties
tls_client_mismatch	the TLS handshake does not offer HTTP/2 the way every modern browser does — typical of scripts, anti-detect tooling, or a client other than the browser the session claims to be
voice_or_audio_anomaly	speech, audio, or media capabilities don’t match the declared OS and browser
gpu_anomaly	reported graphics hardware is software-rendered, a VM driver, or otherwise inconsistent with the declared device
os_claim_inconsistent_with_evidence	OS the browser claims doesn’t match cross-platform rendering evidence, worker behavior, or hardware-permission APIs
vm_or_emulator_indicators	storage, screen geometry, timing, touch capabilities, or system UI details match a VM, headless browser, or emulator profile
uncommon_hardware_profile	reported CPU cores, memory, or low-level numeric behavior fall outside realistic bands for the declared device type
automation_framework_detected	direct evidence of an automation tool driving the browser (webdriver flags, devtools-protocol control, automation artifacts)
font_or_emoji_anomaly	installed font set or emoji rendering reveals an OS different from the one the browser claims
environment_probe_anomaly	minor environment tells (pointer capabilities, timer precision, missing connection metadata) that corroborate stronger signals
android_emulator_or_rooted	Android device is rooted, an emulator, carries a test-keys/debug build fingerprint, or exposes emulator-signature network interfaces
android_device_anomaly	device brand is inconsistent with where it is being used (e.g. a brand not sold in a region appearing on that region’s carriers)
ios_simulator_or_jailbreak	iOS device is a simulator, jailbroken, has a debugger attached, reports software-simulated location, or carries impossible-on-iOS hardware signatures
android_app_integrity_failed	Google Play Integrity reports an app-licensing, app-recognition, or device-recognition failure, or a license verdict Google could not evaluate (signed-out Play account, install outside the Play Store)
ios_hardware_or_version_anomaly	reported iOS version, CPU/version compatibility, memory, core count, thermal, battery, or memory-usage pattern is inconsistent with genuine Apple hardware
android_developer_mode_enabled	USB debugging is on or developer settings are enabled
android_manual_time_settings	automatic time or automatic time zone is disabled on the device — a manually set clock or timezone is a common location-spoofing and device-farm tell
android_clone_or_virtual_app	app is running inside a clone or virtual-app container (dual-space tooling) — one physical device presenting as many
data_collection_blocked	an unusually large share of device probes returned empty or placeholder values, indicating tooling is suppressing data collection
android_abnormal_boot_profile	boot history doesn’t look like a normal personal device: factory-fresh boot counts, a boot count inconsistent with the device’s age, or abnormally high boot counts
mobile_device_locale_null	mobile device reports no locale or language configuration at all — a common device-farm and factory-image tell
chinese_sanctioned_device	device brand is an OEM banned from US networks by the FCC and restricted by carriers in Europe (Huawei, ZTE); fires regardless of score levels so it can be combined with location in rules
chinese_device	device brand is a mainland-Chinese manufacturer brand with little to no US carrier presence; descriptive on its own and typically combined with location in rules