- Device Intelligence - the persistent DeviceID, derived server-side from hundreds of stable device and browser characteristics. It is what lets a returning person keep the same identity after clearing cookies or using incognito.
- Network Intelligence - IP and connection analysis that corroborates a visit across multiple independent signals. It tells you whether a visit is relayed, tunneled, or coming from infrastructure rather than an ordinary network.
Identification accuracy
Identification accuracy is the ability to recognize a returning browser as the same one across visits. The handle for this is the DeviceID, the most durable identifier ShieldLabs produces. The DeviceID is derived server-side, not stored, so it survives cleared cookies, incognito, and IP rotation (see Identification). Because nothing about it lives in the cookie, it holds when cookie-based tracking breaks. This is the difference from cookie analytics. Tools that count by a first-party cookie or client id count a brand-new visitor every time someone clears cookies, opens incognito, or rotates IP. Recognizing by a derived identity keeps that returning person on the same DeviceID instead. A returning visitor is anchored to a stable DeviceID even when the cookie-scopedVisitorID resets:
device_id is the durable handle here. The visitor_id is the cookie-scoped view, so it changes when cookies are cleared while the device_id stays put. The full identifier model walks through how each one is made.
Anonymity-detection accuracy
Anonymity-detection accuracy is the ability to tell that a visit is masked: relayed, tunneled, spoofed, or coming from infrastructure rather than an ordinary network. The mechanism is corroboration across the two layers. An ordinary visitor’s device and network tell the same story; a masked visitor cannot keep both straight. Spoofing one layer is cheap, but making the device — its browser, its OS, its environment — and the network agree at the same time is hard, and that contradiction is what ShieldLabs reads. A simple IP blocklist misses it, because blocklists are always behind: commercial VPNs rotate through large IP pools daily and residential proxies hide on consumer ISPs. This is where the up to 99% comes from, and it is the combination that does it: Device Intelligence and Network Intelligence corroborating each other, not any single signal. A masked visit has to defeat many independent signals across both layers at once. The more signals that must be evaded together, the less often masking slips past all of them, which is what pushes anonymity detection up to 99%, never higher. You never have to take the result on faith. Every verdict is explainable: each signal that fires lands in thesignals array with its weight (the points it added), and the score is the sum of those weights, so you can see exactly why a visit was flagged.
The three layers behind the verdict
The signals come from three layers that check each other. The anonymity signals page lists every one; the Risk Scoring table carries the weights.- Network Intelligence reads the connection: whether the visit is relayed, tunneled, or coming from infrastructure rather than an ordinary network.
- Device Intelligence reads the browser and the device: whether the runtime is spoofed, automated, or stripped.
- Cross-checks fire only when two independent readings of the same visit disagree, for example the OS the browser reports versus the OS the network shows. These are the strongest tell, because making the device’s story and the network’s story agree at the same time is hard.
A worked example
A visit scored70, with the signals that produced it:
70, which lands in the High band (60-100). The Risk Scoring table lists every signal and its weight; the signal label is display-only and can change, so act on the stable detection_flags booleans and what each signal means, not on the label string or the number alone.
Up to 99%, never higher. No detection is perfect, so decide on the score plus its
signals plus your own context, never on a guarantee of certainty.Honest limits
Every accuracy claim has boundaries. Here is where each one stops.- Counts are estimated, not exact. Identity is inferred from the browser and device environment, and anonymity from corroborating signals across the connection and the device, so the dashboard labels visitor counts as estimates. Treat them as a precise-enough signal for decisions, not as a ledger.
- A verdict is a probability, not proof. A high Risk Score means a visit looks anonymous or abusive, not that fraud is confirmed.
- A legitimate user can look anonymous. A corporate proxy, a VPN, or a privacy browser all raise the Risk Score without any wrongdoing.
- You own the action. ShieldLabs surfaces the score and the reasons. Your own code decides allow, challenge, review, or block.
Next steps
Identification
The six identifiers, why the DeviceID is durable, and when the VisitorID resets.
Anonymity Signals
Every signal that can fire and the connection-type label behind it.
Risk Scoring
The explainable 0 to 100 score and its bands: Clean, Low, Medium, High.