Trace Signals

24 smart signals: incognito detection, tampering analysis, VM detection, suspect scoring, and velocity tracking

Smart Signals are server-side enrichment signals computed from browser fingerprints, IP intelligence, and behavioral analysis. They provide deep context about every visitor without collecting any personally identifiable information. Smart signals are included in every identification response when extendedResult: true is set, and are always available via the Server API.

Each smart signal is computed independently on the server after the client SDK submits browser signals. The server combines the browser-collected data with IP intelligence databases, behavioral history, and cross-signal correlation to produce 24 distinct signal outputs. All signals are returned in a single JSON response with sub-50ms latency.

Complete Signal Reference

The following table lists all 24 smart signals with their product key, description, response format, and platform support. Each signal is documented in detail in the sections below.

Network Intelligence Signals

VPN Detection

tracio.ai detects VPN usage through four independent methods. Each method operates independently, and the combined result includes a confidence level reflecting how many methods agree.

1. Timezone Mismatch -- Compares the device timezone (from JavaScript Intl.DateTimeFormat) against the GeoIP timezone. A mismatch indicates the user's network traffic is routed through a different geographic location.
2. Public VPN ASN -- Matches the visitor's IP against a database of 42+ known VPN provider ASNs (NordVPN, ExpressVPN, Mullvad, ProtonVPN, etc.).
3. Relay Detection -- Identifies anonymizing relay services including Apple iCloud Private Relay and Cloudflare WARP by matching IP ranges published by these services.
4. TURN Probe -- Uses a WebRTC TURN server to discover the visitor's real IP address. If the TURN-detected IP differs from the HTTP request IP, VPN/proxy usage is confirmed with high confidence.

Confidence levels:

• High -- Multiple methods agree. Clear VPN usage confirmed by ASN + timezone or TURN probe.
• Medium -- One method triggered with strong indicators (e.g., known VPN ASN only).
• Low -- Minor timezone differences that could be legitimate (e.g., user near timezone boundary).

Response Format

{
  "vpn": {
    "data": {
      "result": true,
      "confidence": "high",
      "originTimezone": "America/New_York",
      "methods": {
        "timezoneMismatch": true,
        "publicVPN": true,
        "osMismatch": false,
        "relay": false
      }
    }
  }
}

Use Cases

• Geo-restricted content -- Enforce geographic licensing requirements by detecting VPN-based location spoofing.
• Fraud prevention -- Flag transactions where the user claims to be in one country but is connecting via a VPN exit in another.
• Account security -- Alert users when their account is accessed from an unusual VPN, potentially indicating credential theft.
• Pricing integrity -- Prevent users from exploiting regional pricing differences by connecting through VPNs in lower-cost regions.

Proxy Detection

Identifies various proxy types including datacenter proxies, residential proxies, HTTP proxies, and SOCKS proxies. Datacenter proxies are detected via ASN matching against known hosting providers. Residential proxies are identified through velocity analysis -- when too many distinct visitor IDs appear from a single residential IP address, it indicates the IP is being shared through a proxy network.

Response Format

{
  "proxy": {
    "data": {
      "result": true,
      "confidence": "high"
    }
  }
}

Tor Detection

Matches the visitor's IP address against a continuously updated list of known Tor exit nodes. The exit node list is refreshed hourly from the Tor Project's directory authorities. Tor detection is supplemented by browser-side signals: Tor Browser has a distinctive fingerprint profile including blocked canvas, blocked WebGL, UTC timezone, a limited font set, and rounded screen dimensions.

Response Format

{
  "tor": {
    "data": {
      "result": true
    }
  }
}

IP Blocklist

Checks the visitor's IP address against aggregated threat intelligence feeds covering known spam sources, attack origins, malware command-and-control servers, and credential stuffing infrastructure. The blocklist is updated daily and covers millions of known-bad IP addresses.

Response Format

{
  "ipBlocklist": {
    "data": {
      "result": true,
      "details": {
        "emailSpam": false,
        "attackSource": true
      }
    }
  }
}

Device Analysis Signals

Virtual Machine Detection

VM detection uses 6 weighted markers derived from WebGL parameters, screen characteristics, and hardware properties. Detection requires either a GPU match (WebGL renderer/vendor containing known VM strings) plus 2 or more additional markers, or 3 or more markers without a GPU match.

1. WebGL renderer containing vmware, virtualbox, parallels, qemu, or hyper-v strings
2. WebGL vendor containing vmware, virtualbox, or parallels strings
3. Common VM screen resolutions (1024x768, 800x600, 1280x800 with desktop UA)
4. Low hardware concurrency (1-2 cores) combined with desktop User-Agent
5. Low device memory (2GB or less) combined with VM GPU indicators
6. Single-core processor with desktop User-Agent (rare on modern physical hardware)

Use Cases

• Fraud prevention -- Fraudsters often use VMs to create isolated browser environments for credential stuffing and account creation.
• DRM enforcement -- Detect VM-based recording or screen capture setups used for content piracy.
• Bonus abuse -- Multi-account abusers use VMs to simulate different devices when claiming sign-up bonuses.

Emulator Detection

Detects mobile device emulators commonly used for app fraud, automated testing, and click farms. The detection cross-references the mobile User-Agent with hardware signals that are impossible or improbable on real mobile hardware, such as desktop-class GPU renderers, unusual screen dimensions, or missing mobile-specific APIs.

Frida Detection

Frida is a dynamic instrumentation toolkit used by security researchers and attackers to hook into running processes, modify function behavior, and bypass security controls. tracio.ai detects Frida by testing for instrumentation artifacts in the JavaScript environment, including hooked native functions, injected globals, and modified prototype chains that are characteristic of Frida's JavaScript bridge.

Browser Analysis Signals

Browser Tampering

The tampering detector identifies visitors who have modified their browser environment to misrepresent their identity. It uses four independent detection strategies:

• User-Agent spoofing -- Cross-references the UA string with Client Hints (navigator.userAgentData), navigator properties, and JavaScript engine behavior to detect mismatches.
• Property injection -- Detects browser extensions that modify navigator properties by comparing getter prototypes against expected native implementations.
• Plugin manipulation -- Verifies PluginArray.prototype and MimeType.prototype chains to detect synthetic plugin lists.
• Native function override -- Tests if Function.prototype.toString and other critical functions have been replaced with Proxy objects or modified implementations.

The anomalyScore (0.0-1.0) quantifies the degree of inconsistency. Values below 0.2 are common with browser extensions and are usually benign. Values above 0.5 indicate significant, deliberate tampering. Values above 0.8 strongly suggest anti-detection browser software.

Anomaly Score Interpretation

Incognito Detection

Detects private/incognito browsing mode across all major browsers. The detection is based on multi-signal correlation since browsers do not expose a direct API for querying private mode status. Detection strategies vary by browser engine: storage quota differences in Chrome, FileSystem API behavior in Firefox, and Safari-specific storage restrictions.

Use Cases

• Paywall enforcement -- Detect users opening articles in incognito mode to bypass article limits.
• Multi-account detection -- Users opening a second incognito session to create additional accounts.
• Price comparison -- Detect incognito usage during checkout to identify price-shopping behavior.

Privacy Browser Detection

Behavioral Signals

Suspect Score

The suspect score aggregates all smart signal outputs into a single risk integer (0-100), making it easy to implement threshold-based access control without writing complex multi-signal logic. The score is computed by summing weighted contributions from six risk categories.

Score Category Weights

The score computation considers 6 categories, each contributing up to its maximum weight:

1. IP Intelligence (0-25 points) -- VPN, proxy, Tor, datacenter IP, blocklist match, residential proxy
2. Bot Detection (0-25 points) -- Automation framework, headless browser, behavioral rate bot
3. Tampering (0-20 points) -- UA spoofing, property injection, native function override, canvas farbling
4. Device Risk (0-15 points) -- Virtual machine, emulator, factory reset, cloned app
5. Privacy (0-10 points) -- Incognito mode, Tor Browser, Brave shields, enhanced tracking protection
6. Behavioral (0-5 points) -- High activity rate, unusual velocity patterns, impossible travel

Velocity

Velocity tracking monitors visitor and IP activity across three rolling time windows. It provides insight into how frequently a visitor appears, how many IP addresses they use, and whether they are connecting from multiple countries. This data is invaluable for detecting account sharing, credential stuffing, and geographic impossibility.

{
  "velocity": {
    "data": {
      "distinctIp": {
        "intervals": { "5m": 1, "1h": 2, "24h": 4 }
      },
      "distinctCountry": {
        "intervals": { "5m": 1, "1h": 1, "24h": 2 }
      },
      "events": {
        "intervals": { "5m": 3, "1h": 12, "24h": 47 }
      }
    }
  }
}

Using Smart Signals

Risk-Based Access Control

const event = await fetchEvent(requestId);
const score = event.products.suspectScore.data.result;
const isVPN = event.products.vpn.data.result;
const isBot = event.products.botd.data.bot.result === 'bad';
const isTor = event.products.tor.data.result;
if (isBot) {
  return block('Automated access detected');
}
if (isTor || score > 80) {
  return block('High-risk access pattern');
}
if (score > 60) {
  return requireMFA();
}
if (isVPN && score > 30) {
  return requireCaptcha();
}
return allow();

Fraud Scoring Pipeline

function computeFraudRisk(event: FPEvent): string {
  const { suspectScore, vpn, proxy, velocity, tampering, tor } = event.products;
  let risk = 'low';
  // Start with suspect score
  if (suspectScore.data.result > 60) risk = 'high';
  else if (suspectScore.data.result > 30) risk = 'medium';
  // Escalate if multiple signals agree
  if (vpn.data.result && proxy.data.result) risk = 'high';
  if (tampering.data.result && tampering.data.anomalyScore > 0.5) risk = 'high';
  if (velocity.data.distinctIp.intervals['24h'] > 10) risk = 'high';
  if (tor.data.result) risk = 'high';
  // Impossible travel: 2+ countries in 1 hour
  if (velocity.data.distinctCountry.intervals['1h'] >= 2) risk = 'high';
  return risk;
}

Account Takeover Detection

async function checkAccountTakeover(userId: string, requestId: string) {
  const event = await fetchEvent(requestId);
  const currentVisitorId = event.products.identification.data.visitorId;
  const knownDevices = await db.userDevices.findAll({ userId });
  // New device accessing this account
  if (!knownDevices.includes(currentVisitorId)) {
    const suspectScore = event.products.suspectScore.data.result;
    const isVPN = event.products.vpn.data.result;
    const velocity = event.products.velocity.data;
    // High-risk indicators on a new device
    if (suspectScore > 40 || isVPN || velocity.distinctCountry.intervals['24h'] > 1) {
      await sendSecurityAlert(userId, {
        type: 'new_device_suspicious',
        visitorId: currentVisitorId,
        suspectScore,
        isVPN,
        country: event.products.identification.data.ipLocation.country.code,
      });
      return { action: 'require_mfa', reason: 'new_device_with_risk_signals' };
    }
    // New device but low risk - just notify
    await sendNewDeviceNotification(userId, currentVisitorId);
    return { action: 'allow_with_notification' };
  }
  return { action: 'allow' };
}