Concepts · Core concepts
Signal catalogue
What each signal measures, and what its silence means.
Signals are what the engine measured about a visit. This page says what each family measures and what its silence means.
Network and address#
| Signal | What it says |
|---|---|
vpn | The address belongs to a VPN service |
proxy | The address is an open or residential proxy |
tor | A Tor exit node |
datacenter | The address belongs to a hosting provider, not a residential ISP |
ip_blocklist | The address has abuse history across several blocklists |
These five are tri-state: true, false, or never looked up. See Measured and unmeasured.
A VPN is not fraud. Corporate employees use VPNs; privacy-conscious people use VPNs. That is why it rarely carries enough weight to refuse on its own.
Browser integrity#
| Signal | What it says |
|---|---|
tampering | A measured surface was interfered with, canvas, WebGL, audio, text geometry |
devtools | DevTools is open, or a debugger is attached |
vm_detection | Signs of a virtual machine |
geo_spoofing | The claimed location contradicts what was measured |
This is the strongest family. An anti-detect browser exists to modify exactly these surfaces, and modifying them leaves traces an honest machine does not have.
Automation#
| Signal | What it says |
|---|---|
bad_bots | Automation markers: the webdriver flag, tooling artefacts, non-browser clients |
good_bots | A known, self-declaring crawler |
bad_bots is the one exception that can prove a negative: every SDK version reads navigator.webdriver, so a visit that read it and fired nothing was measured and clean.
Privacy and device#
| Signal | What it says |
|---|---|
incognito | A private window |
privacy_settings | A blocker or anti-tracking setting is active |
rare_device | A canvas signature the public corpus has never seen |
high_activity | This visitor appears unusually often |
rare_device is a description, not an accusation, and it is deliberately not wired into the score. Rarity is the normal condition of a value chosen for its entropy: 79% of canvas hashes in this project's own data appear exactly once.
Mobile#
frida, jailbreak, ios_simulator, android_emulator, rooted_device, cloned_app, mitm_attack, active_call belong to mobile platforms. The web SDK does not measure them, so on this dashboard they always read as unmeasured.