> ## Documentation Index
> Fetch the complete documentation index at: https://docs.authsignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Risk signals

> Learn how Authsignal calculates the risk signals that you can use in rule conditions, including impossible travel.

Risk signals are the predefined data points that Authsignal calculates each time you track an action. You can use risk signals as conditions in your [rules](https://docs.authsignal.com/actions-rules/rules/getting-started.md).

To see the values for an action, open the action in the Authsignal Portal and find **Action response**.

## Data you need to send

| Attribute | Used for |
| - | - |
| `ipAddress` | IP signals and IP address counts |
| `userAgent` | Known bot |
| `deviceId` | Device is new, Device is remembered, and device counts |

If you do not send an attribute, most of the signals that use it have no value.

## IP signals

### IP is anonymous

`ip.isAnonymous` is `true` if the IP address belongs to a data center, for example a cloud provider. Many VPNs and proxies use these networks. For a VPN that uses a home or mobile IP address, the value is `false`.

### Impossible travel

`ip.impossibleTravel` is `true` if the speed from the [last verified location](#last-verified-location) to the current location is more than 800 km/h. For example, Auckland to Sydney in 2 hours is `true`, and Auckland to Sydney in 4 days is `false`.

Impossible travel is an estimate because it uses the IP location. Some networks, for example in-flight Wi-Fi, can cause incorrect results. If `ip.isAnonymous` is `true`, the value is always `false`.

### Atypical travel

`ip.atypicalTravel` is `true` if the current location is more than 1,000 km from the last verified location. The time after the last verification has no effect.

If `ip.isAnonymous` is `true`, `ip.atypicalTravel` is always `false`.

### IP country code is in OFAC list

`ip.isInOfacList` is `true` if the IP address is in one of these countries: Belarus, Cuba, Iran, Iraq, Ivory Coast, Liberia, Myanmar, North Korea, Sudan, Syria, or Zimbabwe.

This list is fixed and can be different from the current sanctions. To use a different list of countries, use an **IP country code** condition.

## Device signals

### Device is new

`device.isNew` is `true` if the user did not verify successfully on this device before. It is also `true` if you [invalidated](https://docs.authsignal.com/api-reference/server-api/invalidate-device.md) the device after the last verification.

If you do not send a `deviceId`, `device.isNew` is always `true`.

### Device is remembered

`device.isRemembered` is `true` if the user verified successfully on this device and you set a future `rememberedUntil` time with the [update device](https://docs.authsignal.com/api-reference/server-api/update-device.md) API.

The value changes to `false` when the `rememberedUntil` time passes, or when you invalidate the device.

### Known bot

`device.isBot` is `true` if the user agent belongs to a known bot or tool, for example a search engine crawler or curl.

HTTP libraries also count as bots, for example `okhttp`, which many Android and React Native apps use.

## User signals

### Has previously verified

`user.hasVerified` is `true` if the user verified successfully one or more times.

## Counts

| Signal | Portal label | What it counts |
| - | - | - |
| `ip.userCount` | Unique user count | Users on this IP address |
| `ip.deviceCount` | Unique device count | Devices on this IP address |
| `device.userCount` | Unique user count | Users on this device |
| `device.ipAddressCount` | Unique IP address count | IP addresses on this device |
| `user.deviceCount` | Unique device count | Devices for this user |
| `user.ipAddressCount` | Unique IP address count | IP addresses for this user |
| `device.count` | Device count | All devices for this user |

The counts include the current action. They cover the current month and the two months before it. `device.count` covers all time.

## Last verified location

The last verified location is the location of the IP address on the tracked action where the user last completed a challenge.

If Authsignal allows an action without a challenge, the last verified location does not change. If the user did not complete a challenge before, the travel signals have no value.

## Limits of IP location

The IP location is an estimate. The IP location can be far from the user, for example:

* If the IP database knows only the country, the location is the middle of that country.
* In-flight Wi-Fi can show a different country, and the country can change in a few minutes.

For travel signals, use a rule with the `CHALLENGE` outcome, not `BLOCK`. When the user completes the challenge, the last verified location changes to the IP location of that action. Then, the next actions from that location do not trigger the signal.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.