A mobile carrier can put thousands of real subscribers behind a handful of public IPs. So an IP address is a terrible unit for "who is this," and a great unit for "what network is this." Verifence treats those as two different questions — and it answers the network question first, on purpose.
One IP, thousands of people
Carrier-grade NAT is the norm on mobile. Your users don't get a public address each; the carrier multiplexes many subscribers through a shared pool.
That breaks the naive assumption that one IP equals one user. Block the IP and you block a city. Rate-limit the IP and one heavy sender starves everyone else on the same exit node.
You need to identify the subscriber narrowly, and identify the network broadly, at the same time.
Two keys, two zoom levels
Verifence keys the two questions differently.
Velocity — "is this one sender going too fast?" — keys the subscriber as tightly as the address allows: the full IPv4 address, or the /64 for IPv6. A carrier hands a whole /64 to a single subscriber, so /64 is the honest per-user unit even as the lower bits rotate.
Reputation — "is this network a farm?" — deliberately zooms out to the /24 (IPv4) or /48 (IPv6). Fraud farms cluster inside a network block; scoring at that aggregate is what surfaces them.
Same request, two different granularities, because they're answering two different questions.
Reputation runs before velocity
Here's the ordering that matters: reputation is evaluated before velocity counters are consumed.
Picture a farm operating from a /24 that also carries thousands of legitimate mobile users behind carrier NAT. If velocity ran first, every fraudulent send would tick the shared counters before reputation ever weighed in — draining the budget that real users on that carrier are entitled to.
By reading reputation first, a network already known to be bad is rejected without touching anyone's velocity quota. The farm's traffic never reaches the counters it would otherwise poison.
That's the whole reason for the order. Velocity is a shared, finite budget on a shared network. You don't want the layer that catches farms spending the budget of the users the farm is hiding among.
The honest signal underneath
Reputation is only useful because it's grounded in something a farm can't fake: the confirmation rate.
POST /v1/confirm reports that a code was actually entered. Real users type codes in. Farms drive sends and walk away. A network whose sends never convert into confirmations is a network reputation learns to distrust — and once it does, that whole /24 gets stopped at the cheap layer, before it costs the honest users behind it a thing.