> ## Documentation Index > Fetch the complete documentation index at: https://docs.verisoul.ai/llms.txt > Use this file to discover all available pages before exploring further. # Risk Signal Details > Named reason codes that explain the network and device risk scores for a session The `risk_signal_details` object gives you concrete, named reason codes that explain *why* a session's risk scores are elevated. It is returned as a sibling of `risk_signals` and `risk_signal_scores` inside the `session` object on `POST /session/authenticate`, `POST /session/unauthenticated`, and `GET /session/{session_id}`. ```json theme={null} "risk_signal_details": { "network": [ "true_country_mismatch", "ip_on_vpn_list", "ip_device_timezone_mismatch" ], "device": [] } ``` For a clean session the arrays are empty; for a risky session they contain only the reasons that contributed to risk. Signal presence is designed to be safe to write rules against — each signal appears only when there is affirmative evidence for it. ## How signals relate to scores Risk signals are consistent with the scores they explain: a session whose proxy and VPN scores read clean will never carry a proxy- or VPN-related signal, and a session whose device risk score reads clean will never carry a probe-based device signal. Some signals are deliberately independent of score levels because they are meaningful on their own: location-consistency signals such as `true_country_mismatch` and `outside_expected_countries`, and the administrative device-brand signals `chinese_sanctioned_device` and `chinese_device`, which describe a factual property of the device rather than risk evidence and are designed to be combined with location or other conditions in rules. As risk scores increase, sessions typically carry more corroborating signals: a moderately risky session usually shows one or two reasons, while a highly risky session shows several. ## Network Signals Network signals explain the `proxy`, `vpn`, and location-related scores. They describe evidence that the session's network path or claimed location is not what it appears to be. | Risk Signal | Description | | :---------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | network\_latency\_anomaly | connection round-trip timing is anomalously high for the session's region and connection type — the classic pattern of traffic tunneled through an intermediate server | | network\_fingerprint\_anomaly | low-level network fingerprint does not look like the browser the session claims to be | | network\_device\_os\_mismatch | OS inferred from how the device builds its network packets disagrees with the OS the device claims — strong evidence of a proxy relaying traffic from a different machine | | true\_country\_mismatch | the country Verisoul resolves as the user's most likely true location differs from the raw IP country | | ip\_on\_datacenter\_list | IP is hosted in a known datacenter or cloud-hosting range rather than a residential or mobile network | | ip\_device\_timezone\_mismatch | device's configured timezone is geographically far from the IP location | | ip\_device\_lang\_country\_mismatch | device language implies a country inconsistent with the IP location (common benign variants like `en-US` abroad do not fire) | | outside\_expected\_countries | an observed session country (IP or resolved true country) falls outside the account's declared [expected\_countries](/api-reference/types/account); fires only on definitive out-of-list evidence, and only for accounts that declared expected countries | | ip\_on\_proxy\_list | one or more IP intelligence sources flag the IP as a proxy; when both proxy and VPN list evidence exist, only the stronger of the two is emitted | | true\_ip\_leak | a network probe observed an IP revealing a different network identity than the client IP — the user's real address leaking through their proxy or VPN | | ip\_on\_vpn\_list | one or more IP intelligence sources flag the IP as a VPN exit, or it matches a known VPN service; subject to the same either-or rule as ip\_on\_proxy\_list | | mobile\_vpn\_tunnel\_detected | the device's own network configuration shows an active VPN tunnel interface — VPN evidence observed on the device itself rather than from IP intelligence | | mobile\_proxy\_configured | an HTTP proxy is configured in the device's operating-system network settings | ## Device Signals Device signals explain the `device_risk` score. They describe evidence that the device or browser is tampered with, automated, virtualized, or otherwise not a normal personal device. | Risk Signal | Description | | :-------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | browser\_tampering\_detected | browser internals appear modified — anti-detect tooling, failing integrity probes, or manipulated browser properties | | voice\_or\_audio\_anomaly | speech, audio, or media capabilities don't match the declared OS and browser | | gpu\_anomaly | reported graphics hardware is software-rendered, a VM driver, or otherwise inconsistent with the declared device | | os\_claim\_inconsistent\_with\_evidence | OS the browser claims doesn't match cross-platform rendering evidence, worker behavior, or hardware-permission APIs | | vm\_or\_emulator\_indicators | storage, screen geometry, timing, touch capabilities, or system UI details match a VM, headless browser, or emulator profile | | uncommon\_hardware\_profile | reported CPU cores, memory, or low-level numeric behavior fall outside realistic bands for the declared device type | | automation\_framework\_detected | direct evidence of an automation tool driving the browser (webdriver flags, devtools-protocol control, automation artifacts) | | font\_or\_emoji\_anomaly | installed font set or emoji rendering reveals an OS different from the one the browser claims | | environment\_probe\_anomaly | minor environment tells (pointer capabilities, timer precision, missing connection metadata) that corroborate stronger signals | | android\_emulator\_or\_rooted | Android device is rooted, an emulator, carries a test-keys/debug build fingerprint, or exposes emulator-signature network interfaces | | android\_device\_anomaly | device brand is inconsistent with where it is being used (e.g. a brand not sold in a region appearing on that region's carriers) | | ios\_simulator\_or\_jailbreak | iOS device is a simulator, jailbroken, has a debugger attached, reports software-simulated location, or carries impossible-on-iOS hardware signatures | | android\_app\_integrity\_failed | Google Play Integrity reports an app-licensing, app-recognition, or device-recognition failure | | ios\_hardware\_or\_version\_anomaly | reported iOS version, CPU/version compatibility, memory, core count, thermal, battery, or memory-usage pattern is inconsistent with genuine Apple hardware | | android\_developer\_mode\_enabled | USB debugging is on or developer settings are enabled | | android\_manual\_time\_settings | automatic time or automatic time zone is disabled on the device — a manually set clock or timezone is a common location-spoofing and device-farm tell | | android\_clone\_or\_virtual\_app | app is running inside a clone or virtual-app container (dual-space tooling) — one physical device presenting as many | | data\_collection\_blocked | an unusually large share of device probes returned empty or placeholder values, indicating tooling is suppressing data collection | | android\_abnormal\_boot\_profile | boot history doesn't look like a normal personal device: factory-fresh boot counts, a boot count inconsistent with the device's age, or abnormally high boot counts | | mobile\_device\_locale\_null | mobile device reports no locale or language configuration at all — a common device-farm and factory-image tell | | chinese\_sanctioned\_device | device brand is an OEM banned from US networks by the FCC and restricted by carriers in Europe (Huawei, ZTE); fires regardless of score levels so it can be combined with location in rules | | chinese\_device | device brand is a mainland-Chinese manufacturer brand with little to no US carrier presence; descriptive on its own and typically combined with location in rules |