Network Intelligence

Where did the session actually connect from? Network intelligence classifies the connection — commercial VPN, proxy/relay, Tor exit, datacenter/hosting or residential — and enriches it with IP geolocation, ASN, ISP and hosting risk. Every field lands in the risk snapshot; you decide what an anonymising path means for your flow.

Network intelligence is an evidence provider. A VPN is not automatically fraud — many legitimate users browse over one. The snapshot reports the posture; your rules decide whether it matters for this action.

How it works

The moment a session is analysed, its source IP is resolved against network intelligence: the connection is categorised (networkCategory), scored (networkRiskScore), and located (country/region/city with a geoConfidence). Anonymising and hosting paths raise the network risk; a geo signal that disagrees with other evidence sets geoConflictDetected.

Request

The same analyze/analyze-sync call that returns the device signals returns the network posture — no separate endpoint.

<script src="https://cdn.lunixi.com/lunixi-identity.min.js"></script>
<script>
  const client = await Lunixi.identity.init({
    sessionBootstrapUrl: '/lunixi/identity/bootstrap',
    subjectId: 'cus_8f2a9c',
    productContext: 'checkout',
  });
 
  const snapshot = await client.analyze();
  // snapshot.networkCategory, snapshot.vpnDetected,
  // snapshot.asn, snapshot.ipCountry, snapshot.hostingRisk ...
</script>

Snapshot

The network portion of the snapshot:

{
  "networkCategory": "vpn",
  "networkRiskScore": 61,
  "networkPosture": "anonymizing",
  "ipCountry": "NL",
  "ipRegion": "North Holland",
  "ipCity": "Amsterdam",
  "geoConfidence": 0.84,
  "asn": 60068,
  "isp": "Example ISP",
  "provider": "Example Network",
  "hostingRisk": "high",
  "geoConflictDetected": true,
  "networkMatchedSources": ["proxy_intel"],
  "networkMatchedArtifacts": ["vpn_range"],
 
  "vpnDetected": true,
  "proxyDetected": false,
  "torDetected": false,
  "ipBlacklisted": false
}

Signals

Field	What it tells you
`networkCategory`	Network type — residential, hosting, vpn, proxy, tor, …
`networkRiskScore`	Risk magnitude of the network path (0–100)
`networkPosture`	Summary posture label for the connection
`ipCountry` / `ipRegion` / `ipCity`	IP geolocation
`geoConfidence`	Confidence in the geolocation (0–1)
`asn`	Autonomous system number
`isp`	Internet service provider
`provider`	Network/hosting provider label
`hostingRisk`	Hosting/datacenter risk level
`geoConflictDetected`	Geo signals disagree (e.g. IP location vs declared)
`networkMatchedSources`	Which intelligence sources matched the IP
`networkMatchedArtifacts`	Which network artifacts matched
`vpnDetected`	Commercial VPN
`proxyDetected`	Proxy / relay
`torDetected`	Tor exit node
`ipBlacklisted`	The IP is on a block list

The connection is classified across proxy, usage and threat dimensions — commercial VPN, Tor, datacenter/hosting (DCH) and public/residential proxy (PUB) types among them. Each match carries its evidence and method breakdown, so a network verdict is explainable rather than a single opaque flag.

Notes

Network intelligence is live in the hosted product — the platform maintains and refreshes the underlying network intelligence, so VPN/proxy/Tor/hosting detection and geo/ASN/ISP resolution work out of the box, with no feed for you to configure.

A VPN or proxy is a posture, not a verdict. Weigh networkCategory, networkRiskScore and geoConflictDetected together with the rest of the snapshot before acting.
geoConflictDetected is a strong signal to combine with device continuity: a known device suddenly on an anonymising network in a distant geo is more telling than either fact alone.

Next steps

The Risk Snapshot — the full field reference
Device & Continuity — pairing geo conflict with a known device
Bot & Automation — automation over hosting/proxy networks
Server-side API — top-sources: your riskiest network origins

Device & Continuity Bot & Automation