[{"data":1,"prerenderedAt":68},["ShallowReactive",2],{"doc:\u002Fgetting-started\u002Fdata\u002Fprivacy-detection":3},{"page":4,"toc":65},{"path":5,"title":6,"description":7,"blocks":8},"\u002Fgetting-started\u002Fdata\u002Fprivacy-detection","Privacy & VPN detection","How to use security and security_extensions to distinguish VPNs, Tor exits, proxies, and cloud hosting.",[9,12,20,25,48,51,53,61],{"type":10,"text":11},"p","The `security` (`anonymity` family) and `security_extensions` blocks classify whether an IP address masks the user’s network identity and explain why.",{"type":13,"samples":14},"code",[15],{"label":16,"lang":17,"code":18,"html":19},"security + security_extensions","json","{\n  \"security\": {\n    \"is_vpn\": true,\n    \"is_hosting\": true,\n    \"is_tor_exit\": false,\n    \"is_proxy\": false,\n    \"anonymizer_type\": \"vpn\",\n    \"confidence\": 0.96,\n    \"reason_codes\": [\n      \"vpn_handshake_confirmed\",\n      \"datacenter_asn_range\"\n    ]\n  },\n  \"security_extensions\": {\n    \"abuse_velocity_score\": 18,\n    \"is_known_scanner\": false,\n    \"observation_recency_hours\": 12,\n    \"anonymizer_reason\": \"vpn_handshake_confirmed\",\n    \"threat_level\": \"medium\",\n    \"abuse_velocity\": \"low\",\n    \"confidence\": 0.96\n  }\n}","\u003Cpre class=\"shiki ipscope\" style=\"background-color:var(--shiki-background);color:var(--shiki-foreground)\" tabindex=\"0\">\u003Ccode>\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-foreground)\">{\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-keyword)\">  \"security\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">:\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-foreground)\"> {\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-keyword)\">    \"is_vpn\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">:\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-constant)\"> true\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">,\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-keyword)\">    \"is_hosting\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">:\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-constant)\"> true\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">,\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-keyword)\">    \"is_tor_exit\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">:\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-constant)\"> false\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">,\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-keyword)\">    \"is_proxy\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">:\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-constant)\"> false\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">,\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-keyword)\">    \"anonymizer_type\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">:\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-string-expression)\"> \"vpn\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">,\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-keyword)\">    \"confidence\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">:\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-constant)\"> 0.96\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">,\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-keyword)\">    \"reason_codes\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">:\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-foreground)\"> [\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-string-expression)\">      \"vpn_handshake_confirmed\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">,\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-string-expression)\">      \"datacenter_asn_range\"\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-foreground)\">    ]\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-foreground)\">  }\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">,\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-keyword)\">  \"security_extensions\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">:\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-foreground)\"> {\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-keyword)\">    \"abuse_velocity_score\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">:\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-constant)\"> 18\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">,\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-keyword)\">    \"is_known_scanner\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">:\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-constant)\"> false\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">,\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-keyword)\">    \"observation_recency_hours\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">:\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-constant)\"> 12\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">,\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-keyword)\">    \"anonymizer_reason\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">:\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-string-expression)\"> \"vpn_handshake_confirmed\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">,\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-keyword)\">    \"threat_level\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">:\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-string-expression)\"> \"medium\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">,\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-keyword)\">    \"abuse_velocity\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">:\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-string-expression)\"> \"low\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">,\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-token-keyword)\">    \"confidence\"\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-punctuation)\">:\u003C\u002Fspan>\u003Cspan style=\"color:var(--shiki-token-constant)\"> 0.96\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-foreground)\">  }\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\">\u003Cspan style=\"color:var(--shiki-foreground)\">}\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fcode>\u003C\u002Fpre>",{"type":21,"level":22,"text":23,"id":24},"heading",2,"The four boolean flags in `security`","the-four-boolean-flags-in-security",{"type":26,"columns":27,"rows":31},"table",[28,29,30],"Field","True when","Recommended policy action",[32,36,40,44],[33,34,35],"`is_vpn`","Confirmed commercial or self-hosted VPN exit node (`WireGuard`, `OpenVPN`, `IKEv2`).","Step-up MFA or CAPTCHA on sensitive account actions.",[37,38,39],"`is_tor_exit`","Active Tor exit relay in the hourly consensus.","Challenge or block high-risk checkout and signup flows.",[41,42,43],"`is_proxy`","Open HTTP\u002FSOCKS proxy or residential proxy relay.","Require verification on login and payment endpoints.",[45,46,47],"`is_hosting`","Address belongs to a cloud, VPS, or colocation ASN.","Allow for webhook\u002FAPI calls; challenge for consumer signups.",{"type":21,"level":22,"text":49,"id":50},"Deterministic reason codes (`anonymizer_reason`)","deterministic-reason-codes-anonymizer-reason",{"type":10,"text":52},"When your compliance or fraud audit log needs to record *why* an address was flagged, inspect `security_extensions.anonymizer_reason`:",{"type":54,"items":55},"list",[56,57,58,59,60],"`vpn_handshake_confirmed`: active VPN protocol probe or verified exit enumeration matched this IP.","`tor_consensus_exit`: present in the current Tor Project exit list.","`datacenter_asn_range`: routed by a dedicated hosting or cloud provider ASN.","`open_proxy_verified`: active proxy telemetry confirmed open relay behaviour.","`clean_access_network`: residential, mobile, or enterprise access network with no anonymizer indicators.",{"type":62,"tone":63,"text":64},"callout","tip","Avoid hard-blocking `is_vpn: true` on normal browsing. Stepping up to passkey\u002F2FA or requiring email verification stops automated abuse without locking out privacy-conscious customers.",[66,67],{"id":24,"text":23,"level":22},{"id":50,"text":49,"level":22},1793226505436]