range_burst

Your account looked up several numbers in the same range within the window

The Spaw phone risk signal range_burst adds 40 points to risk_score when your own account looked up 5 or more distinct numbers in the same 1,000-number range within 60 minutes, this one included (dataset account-velocity).

risk weight: +40
dataset: account-velocity
reads from: range_seen_by_you
default SMS policy: does not block it on its own: +40 is within the default ceiling of 60, which blocks only a score above it.

What it means

The range is the E.164 number without its last three digits (+14152010142 sits in +14152010xxx), a run of digits rather than a regulator's block. range_seen_by_you answers the count and the window on every counted lookup; from 5 distinct numbers the answer carries this signal, with the dataset account-velocity.

SMS pumping walks consecutive numbers in a range where someone earns a share of every message sent there, and each of those numbers looks clean on its own. In North America, where pumping is rare, a burst more likely means someone is testing numbers against your form or opening accounts in bulk.

Single lookups count (POST /api/v1/phone, the dashboard, the MCP verify-phone tool, the consistency check), and so do browser lookups with a publishable key. A browser answer counts only the browser lookups, so it cannot reveal what your backend looked up.

What it cannot tell you

It reads only your own account's traffic: no other account's lookups are counted, and batch, bulk and monitor runs, the test numbers and the guest demo never count.
It is a heuristic: not every regulator allocates in thousands, and a list checked one number at a time through the single endpoint trips it. Send lists to the batch endpoint, which is never counted.

What to do

Slow the flow or add a challenge for numbers that carry it. On its own it scores 40 and passes the default SMS policy, which blocks a score above 60; beside other signals the score can pass that.

The SMS policy is set per account with PUT /api/v1/phone/policy or the dashboard’s SMS policy tab, and its block_signals may list any signal, this one included; the phone guide lists every rule and its default.

Example response

An excerpt of an answer carrying this signal alone, with the number and the other fields left out, because no test number answers it. The score and the decision are worked out as the lookup and the default SMS policy work them out.

{
    "valid": true,
    "country": "GB",
    "line_type": "mobile",
    "line_type_source": "numbering_plan",
    "risk_score": 40,
    "risk_level": "medium",
    "risk_signals": [
        {
            "signal": "range_burst",
            "weight": 40,
            "dataset": "account-velocity"
        }
    ],
    "range_seen_by_you": {
        "distinct_numbers": 5,
        "window_minutes": 60
    },
    "ok_to_send": true,
    "blocked_by": null
}

A real answer carries every field, listed in the validate-phone reference; the weights of every entry in risk_signals sum to risk_score, capped at 100.

markdown version: /docs/signals/phone/range_burst.md

range_burst

What it means

What it cannot tell you

What to do

Example response

Related