Smart Signals

Smart Signals are server-side enrichment signals computed from browser fingerprints, IP intelligence, and behavioral analysis. They provide deep context about every visitor without collecting any personally identifiable information.

Smart Signals — the enriched decision, risk, network, and bot signals — are delivered via webhooks (see Webhooks) and surfaced in the dashboard. The corresponding fields (decision, risk_score, network flags, bot_score, etc.) are present in the flat read-API event (see Server API Reference) too, but the read query does not populate them — they serialize as their zero/empty values there. The meaningful, enriched values arrive via the webhook payload, whose shape the examples below consume.

Signal Reference

Network Intelligence

Device Analysis

Browser Analysis

Behavioral

Detailed Signal Descriptions

VPN Detection

TRACIO detects VPN usage through four independent methods:

1. Timezone Mismatch: Compares the device timezone (from JavaScript Intl.DateTimeFormat) against the GeoIP timezone. A mismatch indicates the user's network traffic is routed through a different geographic location than their device.

2. Public VPN ASN: Matches the visitor's IP against a database of 42+ known VPN provider ASNs (NordVPN, ExpressVPN, Mullvad, ProtonVPN, etc.).

3. Relay Detection: Identifies anonymizing relay services including Apple iCloud Private Relay and Cloudflare WARP.

4. TURN Probe: Uses a WebRTC TURN server to discover the visitor's real IP address. If the TURN-detected IP differs from the HTTP request IP, VPN/proxy usage is confirmed.

These four methods are internal inputs. The public webhook payload surfaces the combined result as a single boolean, network.vpn — there is no per-method breakdown or confidence string in the delivered payload.

Incognito Detection

Incognito/private browsing is inferred server-side by correlating multiple signals:

• s55 (visitor token): Missing cookie and localStorage token suggests private browsing
• s87 (system colors): Certain CSS system colors differ in private mode
• s89 (OPFS): navigator.storage.getDirectory() behavior changes in incognito
• s106 (indexedDB): Some browsers restrict IndexedDB in private mode

No single signal is conclusive. The server requires correlation across 2+ signals to flag incognito mode.

Browser Tampering

The tampering detector identifies visitors who have modified their browser to misrepresent their identity:

• User-Agent spoofing: Cross-references UA string with Client Hints, navigator properties, and JavaScript engine behavior
• Property injection: Detects extensions that modify navigator properties by comparing getter prototypes
• Plugin manipulation: Verifies PluginArray.prototype and MimeType.prototype chains
• Native function override: Tests if Function.prototype.toString, Object.getOwnPropertyDescriptor, and other critical functions have been replaced with Proxies

The anomalyScore (0.0-1.0) quantifies the degree of inconsistency. Values above 0.5 indicate significant tampering.

Risk and Suspect Score

The webhook decision object carries the aggregated risk for a request: decision.riskScore (integer 0-100), decision.suspectScore (number), and decision.action (the recommended action). The score aggregates the smart signal outputs; the bands below describe how riskScore maps to risk levels:

The score computation considers 6 categories:

1. IP Intelligence (0-25): VPN, proxy, Tor, datacenter
2. Bot Detection (0-25): Automation, headless, behavioral
3. Tampering (0-20): UA spoofing, property injection, native function override
4. Device Risk (0-15): VM, emulator, root/jailbreak, factory reset
5. Privacy (0-10): Incognito, Tor browser, Brave shields
6. Behavioral (0-5): High activity, unusual interaction patterns

A human behavior discount (up to 50% reduction) is applied when mouse/keyboard interaction is confirmed.

Virtual Machine Detection

VM detection uses 6 weighted markers:

1. WebGL renderer containing vmware/virtualbox/parallels/qemu/hyper-v
2. WebGL vendor containing vmware/virtualbox/parallels
3. Common VM screen resolutions (1024x768, 800x600, 1280x800)
4. Low hardware concurrency (1-2 cores) with desktop User-Agent
5. Low device memory (2GB or less) combined with VM GPU
6. Single-core processor with desktop User-Agent

Detection requires a GPU match plus 2+ additional markers, or 3+ markers without a GPU match.

Privacy Browser Detection

Four privacy-focused browser configurations are detected:

Using Smart Signals

Smart Signals reach your server through the webhook payload (see Webhooks for the full shape and signature verification). The examples below read fields directly off that payload.

Risk-Based Access Control

// `payload` is the webhook delivery body (/docs/webhooks)
const score = payload.decision.riskScore
const isVPN = payload.network.vpn
const isBot = payload.bot.result === "bot"

if (isBot) {
  return block("Automated access")
}

if (score > 60) {
  return requireMFA()
}

if (isVPN && score > 30) {
  return requireCaptcha()
}

return allow()

Fraud Scoring Pipeline

// `payload` is the webhook delivery body (/docs/webhooks)
function computeFraudRisk(payload: WebhookPayload): string {
  let risk = "low"

  if (payload.decision.suspectScore > 60) risk = "high"
  else if (payload.decision.suspectScore > 30) risk = "medium"

  // Escalate when multiple network signals agree
  if (payload.network.vpn && payload.network.proxy) risk = "high"
  if (payload.network.tor) risk = "high"
  if (payload.bot.result === "bot") risk = "high"

  return risk
}