Skip to main content
ShieldLabs scores each identification from 0 to 100. Read the score with its named signals and the user’s history to review a login, payment or signup.

​
Risk bands

The webhook field is data.risk_score. A History card uses risk.score when risk.state is ok, and risk.band for that score. 999 means Banned IP on a scored webhook and is outside the scale. It is not a History card score. Handle it before mapping webhook scores to risk bands.

​
The weights

These are the current signal weights. They describe individual detections; use the returned Risk Score as the final result. Grouped contributions are capped at 60 for Proxy, 30 for Check Incomplete and 90 for Bad bot. The overall Risk Score is capped at 100, except for the separate Banned IP value of 999. The signal reference maps source signals to dashboard labels and webhook fields.

​
Read the result

  • Use the returned score. signals explains a result; summing exported weights is not a supported way to reconstruct it.
  • Scores are capped at 100. Two high-weight signals do not create a score above 100.
  • Recognized good bots score 0. Search bots, AI bots and AI browsers have separate source flags.

​
Example: VPN and anti-detect browser

This shortened data example shows the fields returned for an identification:
VPN contributes 30 and Anti-Detect Browser contributes 60: 90, Dangerous. antidetect_browser is a signal slug; anti_detect_browser is the corresponding flag. Do not interchange them.

​
Risk of a user, device, visitor or IP

The analytics dashboard shows Visitor risk, User risk, Device risk and IP risk as Trusted, Suspicious or Dangerous. Each summarizes the proportion of suspicious and dangerous identifications associated with that identifier within the domain. Each identity has its own history, so the four categories can differ even on the same identification. Trusted means the history has not raised the current category. Suspicious reflects an elevated share of suspicious identifications; Dangerous reflects an elevated share of dangerous identifications. These are categories of the identity’s history, not the risk band of its latest check. See what the three current categories mean. The calculation uses all available checks for that key within 90 days. A dangerous share of at least 5% gives Dangerous priority. Otherwise, a suspicious share of at least 5% gives Suspicious; the remaining category is Trusted. Missing history is not treated as Trusted. Changing the period selects activity to inspect; it does not recalculate the category as the worst score in that period. Check the category’s freshness and coverage. See identity risk. High-Risk Event confidence remains separate from the Risk Score of one identification. A user can have a multi-accounting event while its individual checks are Trusted. The webhook and History score fields do not return the current risk category of the associated identities.

​
Caveats

A VPN or private browsing mode can be legitimate. Match the response to the action and the available evidence. A signal’s weight is neither a probability nor proof of fraud. Historical results retain the score and weights calculated at the time. Do not rewrite them using today’s table.

​
Next steps