Email Intelligence - Insights reason code mappings
Telesign Email Intelligence responses may provide extra explanation of how we calculated the risk recommendation for your email address (with an added phone number and/or IP address) in the form of insights reason codes.
Codes that provide an overall conclusion on the relative transaction risk level associated with your email address are found in the “category” package. Codes in the other packages provide insights on the factors contributing to that overall conclusion.
category
Reason codes that provide an overall conclusion on the relative risk presented by the transaction, by placing the transaction in a risk category. This is determined based on weighing the risk and trust signals indicated by the other reason codes.
| Code | Name | Meaning |
|---|---|---|
| 10010 | low activity | Not enough activity or attributes to classify the transaction as either risky or trustworthy. |
| 10020 | low regular activity | Trustworthy category, based on past activity and available information. |
| 10021 | regular activity | Most trustworthy category, based on past activity and available information. |
| 10030 | low‑risk irregular activity | Risky category, based on past activity and available information. |
| 10031 | medium‑risk irregular activity | High‑risk category, based on past activity and available information. |
| 10032 | high‑risk irregular activity | Highest‑risk category, based on past activity and available information. |
email_address
Reason codes related to the activity of the email address you provided. These reason codes are organized into multiple sub-categories.
Activity
Reason codes related to how much activity was observed for this email address, compared to what would be expected for normal email address behavior.
| Type | Code | Name | Meaning | Risk signal | Trust signal |
|---|---|---|---|---|---|
| activity | 60005 | high short-term activity | More than expected activity for this email address over the last 24 hours. | ✔ | |
| activity | 60006 | high long-term activity | More than expected activity for this email address over the past 90 days. | ✔ | |
| activity | 60009 | very high short-term activity | Very high volume of verification traffic on this email address over the past 24 hours. | ✔ | |
| activity | 60010 | very high long-term activity | Very high volume of verification traffic on this email address over the past 90 days. | ✔ |
Static
Reason codes related to the email address’ static attributes rather than measurements of behavior. They are based on fixed properties that do not depend on recent transaction volume or frequency.
| Type | Code | Name | Meaning | Risk signal | Trust signal |
|---|---|---|---|---|---|
| static | 60011 | machine-generated email | Behavior pattern that suggests this email address is being used by a software program. | ✔ | |
| static | 60012 | invalid email | This email address is invalid and could not have been used by a genuine end user. | ✔ | |
| static | 60014 | whitelisted email | The email has been flagged as safe. | ✔ | |
| static | 60015 | blacklisted email | The email has been flagged as a source of fraud. | ✔ |
Domain
Reason codes related to the email address’ domain, like gmail.com.
| Type | Code | Name | Meaning | Risk signal | Trust signal |
|---|---|---|---|---|---|
| domain | 60013 | disposable email domain | This email address may have originated from a service providing temporary email addresses; these temporary addresses can be used to conceal the identity of the end user. | ✔ | |
| domain | 60101 | very low risk domain | Domain shows strong trust signals based on registration and usage patterns. | ✔ | |
| domain | 60102 | low risk domain | Domain shows low-risk characteristics based on registration and usage patterns. | ✔ | |
| domain | 60103 | medium risk domain | Domain shows moderate risk characteristics based on registration and usage patterns. | ✔ | |
| domain | 60104 | high risk domain | Domain shows high-risk characteristics based on registration and usage patterns. | ✔ | |
| domain | 60105 | very high risk domain | Domain shows very high-risk characteristics based on registration and usage patterns. | ✔ |
phone_number
Reason codes specific to the provided or related phone number(s). These reason codes are organized into multiple sub-categories.
Activity
Reason codes related to how much activity was observed for this number, compared to what would be expected for a normal phone number behavior. This takes into account the number of communications transactions (calls, SMS, etc.) to or from this number, the quantity of unique numbers communicated with, and the number of accounts communicated with.
Phone number activity reason codes contain information about the general activity of the phone number, the recency of the phone number, and the behavior of the phone number’s range.
| Type | Code | Name | Meaning | Risk signal | Trust signal |
|---|---|---|---|---|---|
| activity | 20002 | high long-term activity | More activity than expected on this number over the past 90 days. | ✔ | |
| activity | 20003 | high short-term activity | More activity than expected on this number over the last 24 hours. | ✔ | |
| activity | 20006 | sparse long-term activity | Low but regular verification traffic over the past 90 days. | ✔ | |
| activity | 20007 | continuous long-term activity | Continuous, regular verification traffic over the past 90 days. | ✔ | |
| activity | 20008 | very high long-term activity | Very high volume of verification traffic over the past 90 days. | ✔ | |
| activity | 20009 | very high short-term activity | Very high volume of verification traffic over the past 24 hours. | ✔ | |
| activity | 20010 | no activity | Very low or no verification traffic has ever been observed. | ||
| activity | 20011 | low long-term activity | Low volume of verification traffic over the past 90 days. | ||
| activity | 20012 | low short-term activity | Low activity in the last 24 hours and very low or none over 90 days. | ||
| activity | 21003 | machine-like activity | Behavior suggests the number is being used by a bot or automated system. | ✔ |
Recency
Reason codes related to how recently the number was active.
| Type | Code | Name | Meaning |
|---|---|---|---|
| activity | 22001 | seen in the last 1 day | This number was seen in verification traffic in the last day. |
| activity | 22007 | seen in the last 7 days | This number was seen in verification traffic in the last 7 days. |
| activity | 22015 | seen in the last 15 days | This number was seen in verification traffic in the last 15 days. |
| activity | 22101 | seen in the last 1 month | This number was seen in verification traffic in the last month. |
| activity | 22102 | seen in the last 2 months | This number was seen in verification traffic in the last 2 months. |
| activity | 22103 | seen in the last 3 months | This number was seen in verification traffic in the last 3 months. |
| activity | 22203 | not seen in the last 3 months | This number was not seen in verification traffic in the last 3 months. |
Phone Number Range
Reason codes related to how active a risky range (series of consecutive numbers) that the number belongs to has been, if applicable, compared to a good phone number.
Understanding range
Phone number 13105551 13105552 13105553 13105554 In the example above, let’s say the number you submitted to the service is 13105552. Even if there has been no risky activity for that particular number, there might still be risky activity for most other phone numbers in the 131055xx range. In this case the risky activity of the range would contribute to the overall risk level we determine for the submitted number.
| Type | Code | Name | Meaning | Risk signal | Trust signal |
|---|---|---|---|---|---|
| activity | 20101 | no range activity | Very little activity, or none at all, for a risky range this number belongs to over the past 90 days. Also returned if the number does not belong to a risky range. | ✔ | |
| activity | 20105 | high short-term range activity | Very significant activity for a risky range this number belongs to over the last 24 hours. | ✔ | |
| activity | 20106 | high long-term range activity | Very significant activity for a risky range this number belongs to over the past 90 days. | ✔ | |
| activity | 20107 | very high long-term range activity | Extremely significant activity for a risky range this number belongs to over the past 90 days. | ✔ | |
| activity | 20108 | very high short-term range activity | Extremely significant activity for a risky range this number belongs to over the last 24 hours. | ✔ | |
| activity | 21016 | machine-like range activity | Extremely high volume of verification traffic in a very short period (less than 1 hour) on the range this number belongs to. | ✔ |
static
Reason codes related to the number’s static attributes rather than measurements of the phone number activity. They are based on fixed properties that do not depend on recent transaction volume or frequency.
| Type | Code | Name | Meaning | Risk signal | Trust signal |
|---|---|---|---|---|---|
| static | 40001 | premium number | This is a premium number. | ✔ | |
| static | 40002 | VOIP number | This is a VOIP number. | ✔ | |
| static | 40003 | toll-free number | This is a toll-free number. | ✔ | |
| static | 40004 | invalid number | This is an invalid number. | ✔ | |
| static | 40005 | payphone number | This number is associated with a payphone. | ✔ | |
| static | 40006 | voicemail number | This is a voicemail number. | ✔ | |
| static | 40007 | pager number | This number is associated with a pager. | ✔ | |
| static | 40008 | high-risk phone type | This number has another phone type that is risky and not covered by other number_type reason codes. | ✔ | |
| static | 40009 | high-risk carrier | This number is associated with a very risky carrier. | ✔ | |
| static | 40010 | medium-risk carrier | This number is associated with a risky carrier. | ✔ | |
| static | 40011 | high-risk prefix | This number has a risky prefix. | ✔ | |
| static | 40012 | phone too long | This number is invalid because it is too long, even after applying cleansing rules. | ✔ | |
| static | 40013 | blacklisted number | This number has been flagged as a source of fraud. | ✔ | |
| static | 40014 | high-risk country | The country code belongs to a risky country that originates a disproportionate share of fraud attacks. | ✔ | |
| static | 40015 | technical number | This number is used for special technical purposes by telecom companies, such as roaming. | ||
| static | 40016 | number used by application | Telesign reserved this number for customer application use, but it appears to be used for a different purpose. | ✔ | |
| static | 40017 | number whitelisted by customer | The number has been flagged as safe. | ✔ | |
| static | 40018 | phone too short | This number is too short to be a valid phone number. | ✔ | |
| static | 40019 | prepaid number | This is a prepaid number. | ✔ | ✔ |
| static | 40020 | fixed line number | This is a fixed line number. | ✔ | ✔ |
| static | 40021 | personal number | Phone type is personal. | ✔ | ✔ |
ip_address
Reason codes related the IP address related to the provided email address.
activity
Reason codes related to how much activity was observed for the submitted IP address or IP addresses related to submitted attributes.
| Type | Code | Name | Meaning | Risk signal | Trust signal |
|---|---|---|---|---|---|
| activity | 50005 | high short-term activity | More than expected activity for this IP address over the last 24 hours. | ✔ | |
| activity | 50006 | high long-term activity | More than expected activity for this IP address over the past 90 days. | ✔ | |
| activity | 50009 | very high short-term activity | Very frequent changes of IP address attributes in verification traffic over the past 24 hours. | ✔ | |
| activity | 50010 | very high long-term activity | Very frequent changes of IP address attributes in verification traffic over the past 90 days. | ✔ |
static
Reason codes related to the IP address’ static attributes rather than the measurements of the IP address behavior. They are based on fixed properties that do not depend on recent transaction volume or frequency.
| Type | Code | Name | Meaning | Risk signal | Trust signal |
|---|---|---|---|---|---|
| static | 50015 | anonymous proxy | This IP address is associated with anonymous proxies, which can help conceal the true origins of online traffic. | ✔ | |
| static | 50016 | VPN | This IP address is associated with virtual private networks (VPNs), which can help conceal the true origins of online traffic. | ✔ | |
| static | 50017 | hosting provider | This IP address is associated with web hosting servers, which have a pattern of activity different from genuine end users. | ✔ | |
| static | 50018 | TOR exit node | This IP address is associated with Tor anonymous browsers, which can help conceal the true origins of online traffic. | ✔ | |
| static | 50019 | whitelisted IP | The IP address has been flagged as safe. | ✔ | |
| static | 50020 | blacklisted IP | The IP address has been flagged as a source of fraud. | ✔ |
Updated about 4 hours ago