Period and domain
Choose one domain or All domains, select a period and use Refresh to reload. Compare adds the previous-period comparison where data is available. Read the freshness and coverage messages with the numbers.Traffic quality
The gauge summarizes traffic quality on a scale from 0 to 100. Lower values mean less risky checked traffic. The adjacent tiles show saved identifications in the selection and their Trusted, Suspicious and Dangerous split, using each check’s Risk Score rather than the current category of its visitor or account. Repeated checks of the same visitor each count; a call that creates no check does not. Open the count or a tile to inspect the corresponding checks in Analytics. Open Traffic Analytics to compare sources and campaigns. Checks scoring 60 or more count at full weight, while checks scoring 30–59 count at half weight. Checks below 30 remain in the total without adding weight. A weighted sum equal to half the total reaches 100; the result is capped at 100 and rounded to an integer. An empty selection has a value of 0. Read this as the concentration of risk across checks, rather than a percentage of dangerous visitors. The glossary explains the full scope and drill-down views.Users
Users counts accounts with checks in the selection. Each account is counted once within one site; the same User HID on different sites is counted separately. Checks without a valid User HID are excluded. Risky users counts accounts whose current category is Suspicious or Dangerous, based on their available identification history on that site. It does not use the selected period’s highest Risk Score. At least 5% of checks scoring 60 or more gives Dangerous priority; otherwise, at least 5% scoring 30–59 gives Suspicious. The large percentage shows their share among accounts with checks in the period, to one decimal place. A positive share below 0.1% is displayed as 0.1%. N of users below it gives the count. Zero means no accounts in the period have a current Suspicious or Dangerous category. User risk categories are unavailable for this selection means the metric is unavailable; those accounts are not automatically treated as Trusted. High-Risk Event users counts accounts with both a check and saved positive event evidence in the selected period. Multiple positives or event types do not increase one account’s count, so it can differ from the sum of the four event counters. The large percentage shows their share among accounts with checks; ≥ marks a confirmed minimum and the percentage is rounded down. N of users gives the count. Unavailable data or Data is accumulating after capture started means the metric has not yet been established. Zero means no positives were saved in the available data, rather than guaranteeing no events occurred. High-Risk Event users can overlap with Trusted and Risky users: events do not change the account’s current risk category. See Risky users and High-Risk Event users. To populate this panel, pass a stable pseudonymous User HID on authenticated checks. See Accounts and identifications.High-Risk Events
The panel shows accounts with saved positive evidence of Multi-accounting, Account sharing, Impossible travel and Account takeover during the selected period, separated by Medium and High confidence. Read its capture and coverage message: incomplete coverage makes the count a confirmed minimum. An unavailable count or data still accumulating is not proof that no event occurred. Select a supported event tile to open its matching activity. The event’s detector evidence window and the page’s selected reporting period serve different purposes; the UI displays the available scope.Unique visitors
The total counts distinct Visitor IDs in the selected period, domains and filters. Repeated checks of one Visitor ID do not increase it. With all domains selected, each site’s visitors are added separately. This is not a count of people. The same visitors are split into Trusted, Risky visitors, Good bots and Bad bots. Risky visitors combines Suspicious + Dangerous visitors using each visitor’s highest Risk Score in the selected period. One such check is enough. Visitors already counted as Good bots or Bad bots are excluded. Good bots include recognized search and AI traffic; Bad bots groups automation, device spoofing and JavaScript-disabled detections. This counter is separate from the current category on a visitor’s Entity card. A visitor can be counted as risky for the selected period while its current category is Trusted. The Risky visitors tile opens Unique visitors with Suspicious and Dangerous selected. See Risky visitors. A visitor is recognized based on a cookie and a device. See Risk signal groups and Identifiers.Risk signals and latest high-risk identifications
The Risk signals panel highlights key risk detections and shows the share of identifications with each signal. Select a tile to investigate matching activity in Analytics, or use the arrow to open the full list. A check can have several signals, so their shares can total more than 100%. The tiles are Proxy (30–60), Tor Network (99), Anti-Detect Browser (60) and Bad bot (90). Operating System Mismatch is part of Proxy and has no tile of its own. Latest high-risk identifications shows recent checks with a score of at least 60. It is a recent-activity list, not a ranking of the highest scores ever recorded. Select an Identification ID to inspect its identification card.Top lists
Compare countries, browsers, OS, connection types, channels and device types. Risk is the Traffic quality for that group. Select a row to investigate its activity in Analytics.Empty states
Before data arrives, open Integration and confirm the registered domain is reporting. For an empty selection, widen the period or select another domain. Preserve the distinction between zero results, missing user association, and data that could not be loaded. Reading, filtering and exporting the analytics dashboard does not consume identification quota. Overview’s aggregate counters are dashboard metrics; webhooks and History do not return these screen totals.
Current analytics dashboard, rendered locally with synthetic example data.