New IP

A new IP means the connecting address isn't one Rupt has recently associated with this user. Rupt keeps a short sliding window of each user's recent addresses; an evaluation from outside that set flips the is_new_ip check to true.

On its own this is one of the weakest signals there is. IP addresses change constantly: mobile networks rotate them, people move between Wi-Fi and cellular, ISPs reassign them overnight. A new IP is normal for almost everyone almost all the time.

Why it still matters

The value shows up in combination. A new IP next to a new fingerprint, or one that triggers impossible travel, or one that resolves to an anonymizing network, is part of the account takeover story. The address being unfamiliar is what makes the rest of the context meaningful.

Using it

is_new_ip is available as a policy condition, but rarely as a hard rule on its own, since too many real users would trip it. It's most useful weighted into a risk score alongside stronger checks.

The raw IP also feeds geolocation and the anonymizing network flags. The address itself is internal context, not something Rupt exposes back to your users.