Reasons and scores

Every reason an assessment can give, and how they become a decision.

Each reason that fires adds its weight to the score: score = 1 − Π(1 − weight), so independent signals reinforce each other and the score never goes down when a reason is added. With the default thresholds, a score of 0.5 or more is review and 0.85 or more is block. For example, a disposable address alone (0.7) is review; a disposable address over Tor (1 − 0.3 × 0.5 = 0.85) is block.

Lists decide before the score: an allow-list match is always allow (the other reasons are still reported), a block-list match is always block.

Reasons come most significant first. Each has a code, a message for developers, and the details named below (value, suggestion, provider, previous_user…).

Code	Weight	Meaning
`email.invalid`	0.6	The email address is not syntactically valid.
`email.disposable`	0.7	The email domain (or a parent domain) belongs to a disposable-mail service.
`email.undeliverable`	0.6	The email domain can't receive mail: it doesn't exist, has a null MX, or has no MX, A or AAAA record.
`email.role_account`	0.15	A shared or system mailbox (`info@`, `admin@`, `noreply@`…) rather than a person.
`email.typo`	0.2	The domain looks like a typo of a popular one; `suggestion` holds the likely domain, which you may show the user.
`ip.tor`	0.5	The IP address is a Tor exit node.
`ip.vpn_network`	0.3	The IP address belongs to a network mostly used by commercial VPN and proxy services (`provider`).
`ip.hosting_provider`	0.25	The IP address belongs to a cloud or hosting provider (`provider`): usually a script or a proxy, rarely a person.
`ip.private`	0	The IP address is private or reserved: you probably passed your load balancer's or proxy's address instead of the client's.
`velocity.signups_per_ip_1h`	0.35	Many sign-ups from this IP address in the last hour (`value`). Fires at 5 or more.
`velocity.signups_per_ip_24h`	0.3	Many sign-ups from this IP address in the last 24 hours (`value`). Fires at 20 or more.
`velocity.signups_per_subnet_1h`	0.25	Many sign-ups from this IPv4 /24 or IPv6 /64 in the last hour (`value`). Fires at 15 or more.
`velocity.signups_per_email_domain_1h`	0.2	Many sign-ups with this (non-free) email domain in the last hour (`value`). Fires at 20 or more.
`velocity.signups_per_mailbox_24h`	0.3	Repeated sign-up attempts for the same mailbox (dots and `+tags` folded) in the last 24 hours (`value`). Fires at 3 or more.
`velocity.logins_per_ip_1h`	0.3	Many logins from this IP address in the last hour (`value`). Fires at 30 or more.
`velocity.logins_per_user_1h`	0.3	Many logins to this user in the last hour (`value`). Fires at 10 or more.
`velocity.events_per_ip_1h`	0.25	Many events of this kind from this IP address in the last hour (`value`). Fires at 60 or more.
`velocity.events_per_user_1h`	0.25	Many events of this kind from this user in the last hour (`value`). Fires at 60 or more.
`duplicate.canonical_mailbox`	0.5	Another sign-up in this environment already used the same mailbox, with dots and `+tags` folded (`previous_user`, `previous_assessment`).
`history.fraud_mailbox`	0.7	This mailbox was in an assessment you reported as fraud or abuse.
`history.fraud_user`	0.8	This user was in an assessment you reported as fraud or abuse.
`history.fraud_ip`	0.45	This IP address was in an assessment you reported as fraud or abuse in the last 30 days.
`history.fraud_subnet`	0.2	This IPv4 /24 or IPv6 /64 was in an assessment you reported as fraud or abuse in the last 30 days.
`list.blocked`	0	An entry of your block list matched (`entry`, `type`): the decision is `block`.
`list.allowed`	0	An entry of your allow list matched (`entry`, `type`): the decision is `allow`, whatever else fired.

Signals

Besides the reasons, signals reports what COSS found, whether or not it fired a reason:

signals.email: the domain, valid, disposable, deliverability (deliverable, undeliverable or unknown), role_account, free_provider and suggestion.
signals.ip: version, private, tor, hosting with hosting_provider and hosting_kind (cloud, hosting or vpn), asn, as_name and country.
signals.velocity: counts of the same event in this environment, this one included, keyed <dimension>_<window>: ip_1h, subnet_24h, mailbox_24h, email_domain_1h, user_1h… Email domains of free providers are not counted.

IP data comes from public sources: the Tor Project's exit list, the address ranges AWS, Google Cloud, Oracle Cloud and DigitalOcean publish, a list of hosting networks COSS maintains, and IPinfo Lite (ASN and country, CC BY-SA 4.0). They are refreshed every 30 minutes (Tor) to daily.

On This Page

Signals