---
title: New IP
description: A new IP is an address Rupt hasn't seen for this user recently. Weak on its own, but a building block for account takeover and a useful policy condition.
---

# New IP

A new IP means the connecting address isn't one Rupt has recently associated with this user. Rupt keeps a short sliding window of each user's recent addresses; an evaluation from outside that set flips the `is_new_ip` [check](/docs/v3/concepts/checks) to true.

On its own this is one of the weakest signals there is. IP addresses change constantly: mobile networks rotate them, people move between Wi-Fi and cellular, ISPs reassign them overnight. A new IP is normal for almost everyone almost all the time.

## Why it still matters

The value shows up in combination. A new IP next to a [new fingerprint](/docs/v3/concepts/fingerprints), or one that triggers [impossible travel](/docs/v3/concepts/impossible-travel), or one that resolves to an [anonymizing network](/docs/v3/concepts/anonymizing-network), is part of the [account takeover](/docs/v3/concepts/account-takeover) story. The address being unfamiliar is what makes the rest of the context meaningful.

## Using it

`is_new_ip` is available as a [policy](/docs/v3/concepts/policies) condition, but rarely as a hard rule on its own, since too many real users would trip it. It's most useful weighted into a [risk](/docs/v3/concepts/risks) score alongside stronger checks.

The raw IP also feeds geolocation and the [anonymizing network](/docs/v3/concepts/anonymizing-network) flags. The address itself is internal context, not something Rupt exposes back to your users.