Anomaly & VPN Scanner

Identify suspicious visitor signatures, geofence shifts, Tor exit nodes, and automated scrapers utilizing client network attributes.

1. VPN & Proxy Checks

Attackers frequently route web traffic through virtual private networks (VPNs), open proxies, or Tor network exit relays to mask their identities. Sprint Log Parser queries IP metadata attributes during analysis to check:

• Hosting Providers / ASNs: Requests originating from public cloud providers (AWS, DigitalOcean, Hetzner) rather than standard residential ISPs are flagged.
• Tor Exit Nodes: Checks the active IP against the dynamic public Tor relay directory.
• Open Proxies: Inspects headers and checks global open proxy blacklists.

2. Impossible Travel Anomaly

The Impossible Travel engine calculates coordinate deltas between a user's successive authenticated sessions.

For instance, if a user authenticates from an IP located in **Lagos, Nigeria**, and subsequently initiates a session from an IP located in **London, United Kingdom** 10 minutes later, the system marks it as a high-severity anomaly because the physical distance traveled in that duration exceeds average aviation speeds:

Velocity = Haversine(CoordA, CoordB) / (TimestampB - TimestampA)

if Velocity > 800 km/h:
    Trigger "Impossible Travel Anomaly" Alert

3. Crawler & Scraping Rules

High-volume automated scanner tools (like Go-http-client, python-requests, or custom Node user agents) are automatically identified by parsing raw User-Agent headers, preventing scraper bots from harvesting endpoints silently.