Identification card

Open an Identification ID from Analytics, the Overview’s latest high-risk checks, or an entity card. The identification card explains one check and links it to the associated user, device, visitor and IP. The header shows Identification ID and the check time, Seen. The latest-high-risk list contains recent checks scoring at least 60; it is not a ranking of the highest scores.

​

Risk Score and risk signals

The card shows a Risk Score from 0 to 100: Trusted 0–29, Suspicious 30–59 or Dangerous 60–100. The weighted detections explain it. VPN (30) and Anti-Detect Browser (60), for example, produce 90, Dangerous. Analytics dashboard labels can combine several underlying flags. Proxy includes proxy, latency and mismatch detections; Bad bot groups automation, device spoofing and JavaScript-disabled detections. The displayed group weight is already included in the Risk Score; do not add it again. If no signal fired, the list shows No risk signal fired. A recognized good bot can have its company name beside the signal. See Risk signals and Risk Scoring. Informational flags can appear with zero weight. The special value 999 means Banned IP and sits outside the normal score range.

​

Details

Read the Identification ID, Visitor ID, Device ID, Cookie ID, Session ID, User HID and domain. Use the Identification ID to retrieve the same check through History. Open an identity to inspect its history. Visitor ID, Device ID and User HID open the corresponding Entity cards. An anonymous check has no associated User.

​

Risk of the identities in this call

Visitor risk, User risk, Device risk and IP risk summarize the identification history linked to each identifier. Each category reflects the proportion of suspicious and dangerous checks in its own history, so the four labels can differ from each other and from this check’s Risk Score. Read their scope and evaluation time. For these identity labels, Trusted means the history has not raised the category, Suspicious reflects an elevated share of suspicious checks, and Dangerous reflects an elevated share of dangerous checks. The numeric ranges shown for this identification’s score do not describe the four identities’ current categories. See current category meanings. A Trusted identification can belong to a Dangerous user because of the account’s history. High-Risk Events are shown separately. See what each identity’s risk includes. An anonymous check has no authenticated user. Missing or unavailable enrichment does not establish low risk. These are current categories, rather than categories recorded at the time of this check. A dash means the identifier is absent or its category is unavailable. High-Risk Event labels are separate; open the user’s Entity card for its clusters and graph.

​

Device and network

Review browser, OS, device type, connection type, public IP and country, and the additional local IP and country when available. Local IP can be a public address exposed by browser network checks; it does not always refer to a private LAN.

​

Traffic source

The block shows Channel, Referrer, Entry page, Click ID type, UTM Source, UTM Medium, UTM Campaign, UTM Content and UTM Term. Entry page is the page where this check ran, which is not necessarily the first page of the visit. An empty field means no value is available. These attribution fields do not affect the Risk Score. See Traffic Analytics. Webhooks and the History API return check data, rather than the dashboard card itself.