Threat Guard with IP Quality Score

This section elaborates on the IPQualityScore's role as a Source of Risk in the Threat Guard system and its impact on triggering specific security actions. To gain a comprehensive insight into how IPQualityScore integrates with the overall functionality of Threat Guard, we recommend referring to the main Threat Guard documentation. This detailed overview will help understand the nuances of how IPQualityScore's risk indicators influence the security protocols within the Threat Guard framework.

IPQualityScore Source of Risk Action Triggers

Bot Detector: IPQualityScore will send indicators to the Next Identity Threat Guard service to indicate that a bot has been detected; triggers for bot detection are not configurable.

Risk Detector: - IPQualityScore will send a score to the Next Identity Threat Guard service to indicate a risk level based on a variety of considered inputs and user behavior. The “score” attribute will be numerically between 0 and 100. Risk Detector has three levels (high risk 85+, medium risk 75-84, low risk 0-74), and those ranges are hard-coded into the Threat Guard service and cannot be adjusted by the customer.

New Device Detector: IPQualityScore will send indicators to the Next Identity Threat Guard service to indicate that a new device has been detected; triggers for new device detection are not configurable.

Impossible Travel Detector IPQualityScore does not provide impossible travel indicators. Instead, applications that use IPQualityScore will need to get Impossible Travel Indicators from another source (Google Distance Matrix API).

Matrix of Available Actions Based on Signal Triggers from IPQualityScore

📘

Note on the table below

The user only needs to complete the two-step verification process once. If in the scenario they are flagged twice (i.e., new device plus fraud detection), completing it once fulfills the requirement.

Login MethodNew DeviceBot DetectedFraud Detected 85+Fraud Detected 75-84Fraud Detected <=74Impossible Travel Detected**
Email + passwordnone, email notification,
step up auth, or both step up auth and email notification
blockblockstep up authallowstep up auth
Email + password + 2FAallowblockblockallowallowallow
Mobile phone number + passwordstep up authblockblockstep up authallowstep up auth
Mobile phone number + password +2FAallowblockblockallowallowallow
Email OTPemail notificationblockblockallowallowallow
Mobile OTPallowblockblockallowallowallow
Social Authenticationallow and step up authblockblockstep up authallowstep up auth
Biometric Authenticationemail notification and step up authblockblockallowallowallow

**As previously mentioned, IPQualityScore does not provide impossible travel indicators. In this case, applications must get this from another source (Google Distance Matrix API).