The same IP address answers two different questions inside Verifence, so it gets keyed two different ways. Truncate it one way to ask "is this one customer sending too fast?" Truncate it wider to ask "is this network a farm?"
Getting the width right on each is the difference between catching abuse and either missing it or punishing bystanders.
Velocity: as narrow as one subscriber
The velocity key identifies a single sender. You want the narrowest thing that still maps to one customer.
- IPv4 — the full address. One v4 address is one endpoint; nothing to trim.
- IPv6 — the /64, not the /128.
The /64 is deliberate. Carriers hand a whole /64 to a single subscriber, and the interface ID — the low 64 bits — rotates freely on the device. Key the full /128 and one handset can walk its own address space, minting a fresh counter for every send and resetting its own velocity limit at will.
Key the /64 and the subscriber is pinned no matter how the interface ID churns. The counter follows the customer, not the current address.
Reputation: deliberately wider
The reputation key asks a different question — is the network behind this a fraud farm? — so it aggregates much wider.
- IPv4 — the /24.
- IPv6 — the /48.
A farm doesn't operate from one address; it operates from a block. Aggregating to /24 and /48 lets the confirmation signal accumulate across the whole network, so a bad neighborhood gets recognized as one even as individual addresses shift underneath it.
Two questions, two widths. Narrow to hold a customer accountable; wide to hold a network accountable.
Keys come from parsed bytes, not the string
Both keys derive from the parsed bytes of the address, never the raw text a client sent.
That matters because one address has many spellings. 2001:db8::1, 2001:0db8:0000:...:0001, upper case, lower case — all the same 128 bits. Key the string and each spelling opens a fresh counter, which is exactly the reset-your-own-limit hole again, this time through formatting instead of the interface ID.
Parse first, then truncate, then key. Every spelling of one address collapses onto one counter.
IPv4-mapped IPv6 folds back to v4
One more normalization: an IPv4-mapped IPv6 address (::ffff:a.b.c.d) is keyed as the underlying IPv4 address.
The same real endpoint might reach you as 203.0.113.7 on one request and ::ffff:203.0.113.7 on another, depending on the network stack in front of it. They're the same host. They share the same key. An attacker can't split their counter by toggling the representation.
The principle
One address is not one fact. It's a customer and a network, and those want different resolutions. Verifence answers each at the width that question deserves — and normalizes hard first, so no amount of respelling buys a fresh start.