Suspicious Activity and VPN Detection
MediaShield Pro proUpdated
Pro feature. Available in MediaShield Pro.
PRO - requires MediaShield Pro.
MediaShield Pro watches viewing patterns and adds a row to an Alerts list when something looks unusual, such as one account watching from many IP addresses. It only flags. It does not email you, block anyone or take action. You have to open the list. The weekly digest reports a count of alerts and nothing more.
Why use it#
Account sharing and odd viewing patterns show up in one list, so you do not have to read raw logs. It flags only. You decide what to do, and nothing is blocked automatically.
Before you start#
- Alerts come from watch sessions, so the video must use a protection level that records sessions (Standard or Strict).
- Decide who reviews the list and how often. Nothing will tell you it has new rows.
Open the Alerts list#
- Go to MediaShield > Alerts.
- The list shows alerts that have not been dismissed, newest first, with Severity, Type, User, Video and When. Use Next and Previous to page.
- With no alerts you see "No suspicious activity detected. All clear."
The list does not show the explanatory sentence that is saved with each alert (for example how many IP addresses were seen). It shows the type, who, which video and when.
What is detected#
| Type | What it means | Severity | Turned on |
|---|---|---|---|
| Multiple IP addresses | One account started sessions from several different IP addresses inside a time window | Warning | Always |
| Developer tools opened | The viewer opened browser developer tools. Shown as "Site-wide" because it is not tied to one video | Warning | Always (needs the free devtools detection setting on) |
| Rapid seeking detected | The viewer jumped past 80 percent of a video within 30 seconds of starting it | Warning | Always |
| VPN/proxy detected | The viewer's IP address belongs to a proxy or a datacenter | Info | Off until you switch it on and add a key |
| Concurrent stream limit | Listed as a type, but nothing creates this alert. The free plugin enforces the limit itself and shows the viewer a message | - | Not generated |
Alerts are per member. Keep login required if you want each alert tied to one named account.
Detection sensitivity#
Open Detection Sensitivity on the Alerts screen. It changes only the Multiple IP addresses rule.
| Level | Flags when | Notes |
|---|---|---|
| Low | 10 or more different IPs in 24 hours | Fewest false alarms |
| Medium (default) | 5 or more different IPs in 12 hours | Recommended for most sites |
| High | 3 or more different IPs in 6 hours | More alerts |
Phones that move between Wi-Fi and mobile data, and people who travel, will trigger this. Treat an alert as a reason to look, not as proof.
Rapid seeking can also be triggered by an honest viewer who resumes a video that they had almost finished, because the player jumps to the saved position.
Review an alert#
Each row has two buttons.
- Dismiss: you have seen it. It leaves the list. Dismissed alerts are deleted after 90 days. Alerts you never dismiss are kept.
- Mark as Safe: you trust this person. Their open alerts are dismissed and no new alerts are created for them. This cannot be undone from the screen. Use it for staff and testers.
VPN and proxy detection#
This is off by default. It stays off until two things are true:
- The switch Check visitors against a VPN / proxy database is on.
- An ip-api.com API key is saved.
How to set it up:
- Get a key from ip-api.com (the paid plan, which supports secure HTTPS lookups).
- On MediaShield > Alerts, find the VPN section, paste the key in ip-api.com API key and click Save key. "API key saved. VPN / proxy detection can now run." appears.
- Turn the switch on. "VPN / proxy detection enabled." appears.
To remove the key, save the field empty. "API key cleared. VPN / proxy detection will not run."
What you need to know before enabling it:
- Each new viewer IP address is sent to a third party (ip-api.com) over HTTPS. An IP address is personal data in the EU and the UK. Cover it in your privacy policy, or do not enable it.
- Without a key nothing is sent. The page warns you if the switch is on and no key is saved.
- Private and local addresses are not looked up.
- Results are remembered for a day, and a failed lookup is remembered for an hour, so one address is not asked about over and over.
- The check is queued in the background and never slows the player.
- Corporate networks and some mobile carriers sit on datacenter or proxy addresses, so real members get flagged. This is why it is only an Info level flag.
What viewers see#
This is an admin screen. Viewers are not told, and their playback is not blocked.
Settings and options for this feature#
| Setting | Where | Default | What it does |
|---|---|---|---|
| Detection Sensitivity | Alerts | Medium | Threshold for the Multiple IP rule |
| Check visitors against a VPN / proxy database | Alerts | Off | Turns VPN lookups on. Needs a key |
| ip-api.com API key | Alerts | empty | Key for the lookup. Never shown again after saving |
| Safe users | Alerts (Mark as Safe) | none | People who never raise alerts |
Next steps#
- Make leaks traceable with the advanced watermark.
- Get a weekly count in your inbox.
- Export sessions to review IP addresses.
If alerts are missing or too noisy, see Troubleshooting.