Two ways, default key is [IP address + User ID] we also have a fallback with a higher limit on [IP address] only when we expect lots of attempts from e.g. a VPN.

The problem I had with IP address fingerprints is that we have a large number of customers all behind one hospital’s single IP address.