IP screening provides information about the approximate location, network and characteristics associated with an IP address. These signals can help identify unusual activity and provide additional context for risk, fraud and AML assessments.

IP information should generally be treated as risk context rather than evidence of suspicious activity on its own.

Geolocation

The Geolocation section shows the location associated with the IP address:

• Postcode, City, Region and Country – the approximate geographic location associated with the IP.
• Continent – the continent associated with the location.
• Timezone – the timezone associated with the IP’s location.
• Latitude and Longitude – approximate coordinates for the IP’s identified location.

IP geolocation does not represent the precise physical location of a person or device. It identifies the approximate location associated with the IP and network infrastructure and is generally accurate to a city or regional level rather than a street address.  

This can be useful when comparing an IP’s location with information already known about a customer, such as their expected country of residence.

Network (AS)

The Network (AS) section identifies the network responsible for the IP address.

• ASN – Autonomous System Number, a unique identifier for the network.
• Name – the organisation operating the network.
• Domain – the domain associated with the network operator.
• Type – the type of network, for example isp or hosting.

An ISP (Internet Service Provider) typically provides internet connectivity to residential or mobile users, while a hosting network typically represents cloud, server or data-center infrastructure. Other network types may also be returned.  

Network information can provide useful context. For example, a consumer accessing a service through a normal ISP may be expected, whereas traffic from hosting infrastructure may warrant additional consideration depending on the use case.

Flags

Flags provide additional information about characteristics detected for the IP.

A "✓" indicates that the characteristic has been detected, while an "×" indicates that it has not been detected.

Anonymous and Hosting are separate signals

It is important to distinguish between Anonymous and Hosting.

An IP can, for example, be:

• Anonymous ✓ + Hosting × – anonymisation has been detected, but the IP is not classified as hosting infrastructure.
• Anonymous × + Hosting ✓ – the IP belongs to hosting infrastructure, but no anonymisation has been detected.
• Anonymous ✓ + Hosting ✓ – anonymisation has been detected on an IP also associated with hosting infrastructure.
• Anonymous × + Hosting × – neither characteristic has been detected.

Hosting infrastructure is not inherently suspicious. It is commonly used for APIs, servers and business systems. Similarly, anonymisation services have many legitimate uses, including privacy, remote work and corporate network access.

Anycast also deserves some care when interpreting geolocation. Because an anycast IP can be served from multiple locations, its displayed geographic location may not represent the location from which a particular request was handled.

Using IP data in risk assessments

No individual IP field or flag should generally be treated as proof of suspicious activity. Instead, the information is most useful when combined with other customer and behavioural data.

For example, additional review may be relevant when an anonymised or hosting IP occurs together with an unexpected country, unusual account activity, transaction behaviour or other risk indicators.

The appropriate weighting ultimately depends on the use case. A hosting IP may be completely normal for an API request, for example, while being less expected during a consumer KYC journey.