Skip to main content

​
Scoring Rules

ShieldLabs applies several rules that modify how signals combine. These reduce false positives for legitimate VPN users and browser extension proxies.

​
Exclusive IP flags

When certain IP intelligence flags fire, other signals are not counted:
FlagScoreEffect
Is tor+99All other IP and connectivity signals ignored
Is privacy relay+15All other IP signals ignored
Is VPN+15Proxy/datacenter/abuser and most connectivity signals ignored
Tor and Privacy Relay take highest priority, then VPN.

​
VPN detection: 2-of-3 rule

VPN is not triggered by IP database alone. Three signals are evaluated:
#SignalSource
1IP API is_vpnipapi.is
2TCP VPN hintShield.Tcp MSS/MTU analysis (vpn, tor_double_vpn)
3STUN failedNo STUN binding within scoring window
Threshold:
  • TCP data available → 2 of 3 signals required → Is VPN (+15)
  • No TCP data for this IP → 1 of 2 (IP API + STUN only)
If VPN is confirmed, proxy/datacenter/abuser flags and STUN/timezone signals are not added separately.

​
Example: VPN user with STUN OK

IP API is_vpn:     ✓
TCP hint:          ✗ (direct)
STUN:              ✓ passed
─────────────────────────
VPN: NOT detected (only 1/3 signals)
Score: 0 (if no other flags)

​
Example: VPN with STUN blocked

IP API is_vpn:     ✓
TCP hint:          ✓ (vpn)
STUN:              ✗ failed
─────────────────────────
VPN: DETECTED (2/3)
Is VPN: +15
Score: 15

​
Browser VPN/Proxy collapse

When the browser appears to use an extension VPN or proxy (datacenter/abuser IP + OS mismatch, but not confirmed VPN), individual flags are replaced with a single signal: 
Before:
  Is datacenter:        +10
  Fail by Mac OS detect: +60
  Stun is not checked:  +30
  Raw total: 100

After Browser VPN/Proxy rule:
  Browser VPN/Proxy:    +30
  Score: 30
Suppressed signals remain in debug audit entries with Value: 0. Conditions:
  • Datacenter or abuser IP from ipapi.is
  • UA OS ≠ TCP OS (both detected)
  • VPN 2-of-3 rule not triggered
  • Not antidetect or JavaScript-disabled

​
OS mismatch scoring

When User-Agent OS and TCP fingerprint OS disagree (and neither is “not detected”), a single mismatch signal fires at +60 (not +30 per OS): 
UA: macOS, TCP: Windows → Fail by Mac OS detect (+60)

​
Practical score guide

ScenarioTypical score
Clean residential user0
VPN user, STUN OK, no TCP hint0–15
VPN confirmed (2-of-3)15
Browser extension VPN30
OS mismatch (anti-detect)60
Antidetect port scan60+
OS mismatch + STUN fail + datacenter60–100
Tor exit node99
Rate limit ban999
See Trust Score for integration thresholds.