Decision Console includes two Attribute Details that show whether an identity’s email or IP address has a history of exposure or misuse. The Data Breach Report on the Email Attribute Card shows how often and how recently an email has appeared in a known data breach. The IP Abuse Report on the IP Address Attribute Card shows reported malicious activity tied to a high-risk IP.
Both reports are built in part on data shared by Trestle’s customers and partners, including emails or IP addresses they know have been compromised. The more review outcomes our network shares, the more accurate these signals become for every team that uses them. If your team tracks dispositions and wants to contribute, reach out to your account executive.
This article walks through where to find these reports and how to factor them into your manual review workflow:
- Data Breach Report: An Attribute Detail at the bottom of the Email Attribute Card.
- Email Breach History: A section in the Email Details Panel listing the five most recent breaches tied to that email.
- IP Abuse Report: An Attribute Detail at the bottom of the IP Address Attribute Card that summarizes reported abuse tied to that IP address.
Email Data Breach Report #
The Data Breach Report appears at the bottom of the Email Attribute Card whenever the input email has been found in at least one known data breach. If no breaches are found, the details will not appear.
How Do I Read the Email Data Breach Report? #
The Data Breach Report shows how many times the email has appeared in a breach and when the most recent breach occurred. The color of the Attribute Detail reflects how recent the last breach was:
| Color | What it means |
| Red | The email was found in a breach within the last 6 months. |
| Gray | The most recent breach was more than 6 months ago. |
Reviewing Breach History in the Email Details Panel #
Click View Details → at the top of the Email Attribute Card to open the Email Details Panel. The new Email Breach History section sits below Social Profiles and lists the five most recent breaches tied to the email.
| Field | What it tells you |
| Breached Organization | The company or service whose database was breached. |
| Breach Date | When the breach occurred. |
| Data Exposed | The types of personal data exposed in the breach, such as email addresses, passwords, phone numbers, or IP addresses. |
How Should I Interpret the Data Breach Report? #
Breach exposure is common. Many legitimate people have an email that appeared in at least one breach, so the Data Breach Report alone isn’t a fraud signal. It becomes meaningful in context.
| What you see | What it may indicate | Suggested next step |
| A red Data Breach Report, and the Email Breach History in the Details Panel lists passwords or security questions as the type of data exposed in the breach. | The email’s credentials have appeared in a breach within the last 6 months, and that breach exposed login information. Someone other than the owner may now have the password to this email or accounts tied to it, which raises the risk of account takeover. The person submitting the email could be a fraudster using stolen credentials, and the real owner could be a victim. | Give this signal more weight on logins, password resets, or account changes. Consider step-up verification before approving. |
| Gray detail with older breaches only. | The email has likely been in use for years. Older exposure is common among long-standing, legitimate emails. | Weigh lightly. It can support other signals that the email is established and legitimate. |
| No Data Breach Report | No known breaches were found for this email. | Don’t treat this as proof of legitimacy. Pair it with Email Age Score to determine how established the email address is since a brand-new email with no history of any kind deserves a closer look. |
These interpretations are a starting point. Validate them against your own review outcomes before building them into your team’s policies.
IP Abuse Report #
Where Do I Find It? #
The IP Abuse Report appears at the bottom of the IP Address Attribute Card, highlighted in red, when the IP has at least one abuse report on record. It shows the total number of abuse reports and the top abuse category.
Shared Connections #
Many IP addresses are shared. Mobile carriers, public Wi-Fi networks, and large internet providers route thousands of people through the same addresses, so a legitimate user can inherit reports caused by someone else. Check the connection type and IP Trust Score before acting on an IP Abuse Report alone.
Types of IP Address Abuse #
The Attribute Detail surfaces the top abuse category. These categories fall into the groups below:
| Group | Includes activity such as | Why it matters in a review |
| Fraud and Impersonation | Fraudulent orders, phishing, VoIP fraud, email sender spoofing | Most directly tied to transaction and identity fraud. |
| Spam | Unsolicited email, forum, comment, and blog spam | Common among automated signups and low-quality leads. |
| Credential Attacks | Repeated login attempts against websites and server, general hacking attempts | Relevant to account creation, logins, and account takeover. |
| Web Application Attacks | Database injection attempts, proving for software vulnerabilities, scraping bots that ignore site rules | Signals automated or malicious tooling behind the connection |
| Network Attacks | Participating in denial-of-service attacks, scanning for open ports, tampering with domain records | Suggests the IP is part of attack infrastructure, such as a botnet |
| Anonymized or Compromised Connections | Open proxies and relays, VPN use, malware-infected devices, attacks aimed at smart devices | The person behind the connection may be masking their location or using a device someone else controls. |
How Should I Interpret an IP Abuse Report? #
An abuse report describes the IP address, not the person. Read it alongside other signals on the card and in the Decision Overview:
- Your Use Case: Fraudulent order reports matter most for eCommerce checkouts, while credential attacks matter most for account logins and signups.
- Corroboration Among Multiple Signals: A phishing abuse report paired with a Hosting or VPN connection type, a large distance from the input address, and an identity whose name, address, and phone number don’t match is a very strong case for rejection.
Note: If no IP Abuse Report appears, don’t treat the IP address as low risk on its own. Review the IP Trust Score and other details on the card.
Where Are Email Breach Reports and IP Abuse Reports Available? #
These reports are available in Decision Console at no extra cost. If you’re interested in trying Decision Console for yourself, reach out to your account executive or email support@trestleiq.com.
For more information about Decision Console, check out these articles: