| Device | Anomalies related to the device being used by a particular user, including device fingerprints, device environments, and cookies | - Multiple users logging in with the same device fingerprint or cookie
- A single user logging in from an anomalous device fingerprint
|
| Network | Anomalies associated with network identifiers from where the user makes a connection | - Multiple users logging in with the same IP
- Evidence of proxying
- Users logging in from anomalous ASNs
|
| Location | Anomalies associated with the location of the user | - A single user logging in from two different countries within a short time period
|
| Behavior | General anomalies in the behavior and visitation patterns of a user | - A single user or group of users with abnormally high volume of traffic
- Users visiting paths through an invalid flow
|
