> For the complete documentation index, see [llms.txt](https://fulbix.gitbook.io/fulbix-fraud-and-ip-blocker/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://fulbix.gitbook.io/fulbix-fraud-and-ip-blocker/setup/risk-score-explained.md).

# Risk Score Explained

### What Is a Risk Score?

Every visitor who arrives at your store is assigned a **Risk Score** — a number from 0 to 100 that represents how likely that visitor is to be using anonymous or fraudulent technology to hide their identity.

**A higher score means a higher chance the visitor is concealing who they are.**

This score comes from **proxycheck.io**, a third-party IP intelligence service that Fulbix queries for every visitor.

proxycheck.io analyzes the visitor's IP address and returns a single 0–100 risk value that already factors in:

* Whether the IP belongs to a known VPN provider
* Whether the IP is a proxy or data-center/hosting address
* Whether the IP is a TOR exit node
* The IP's history of abuse and fraud reports

Fulbix uses this score directly — it is not recalculated or adjusted by Fulbix.

> If proxycheck.io cannot be reached for a request, Fulbix falls back to a risk score from Cloudflare's threat intelligence instead.

***

### Score Bands

Fulbix groups the proxycheck.io score into three bands for display.

Each band is shown with a colored badge in the visitor log.

These bands are Fulbix's own thresholds applied to the score — they are not categories defined by proxycheck.io itself.

| Badge                   | Score range | What it means                                                                                                                                              |
| ----------------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Trusted** (green)     | 0 – 39      | proxycheck.io reports low/no risk for this IP. Likely a regular customer or legitimate user.                                                               |
| **Suspicious** (yellow) | 40 – 74     | proxycheck.io reports moderate risk — possibly a shared proxy or known anonymizing service. Warrants caution but not necessarily a block.                  |
| **Risky** (red)         | 75 – 100    | proxycheck.io reports high risk — typically a known malicious proxy, data-center IP, or TOR exit node. High probability of automated or fraudulent intent. |

***

### What Risk Score Does NOT Tell You

The risk score measures **network anonymization**, not purchase fraud.

A visitor with a score of 80 is very likely hiding their identity — but it does not automatically mean they will place a fraudulent order.

Use the risk score as one signal alongside your Fraud Rules.

#### Example

* A score of 80 + a blacklisted country = high confidence, block immediately
* A score of 45 with normal browsing behavior = review in the visitor log, do not automatically block

***

### Where You See the Risk Score

#### Visitor Log

**Analytics → Visitors**

Every session row shows the risk badge:

* Trusted
* Suspicious
* Risky

#### VPN Blocker

**Security → Bot Protection**

You set a threshold.

Any visitor whose score meets or exceeds that threshold triggers the block action you chose.

See Article 5 for how to configure this.

***

### Recommended Threshold Settings

| Store type                                       | Recommended threshold | Why                                                          |
| ------------------------------------------------ | --------------------- | ------------------------------------------------------------ |
| International store, wide audience               | 70 – 80               | Avoids blocking legitimate privacy-conscious users           |
| High-risk categories (electronics, luxury goods) | 50 – 60               | Stricter — worth accepting some false positives              |
| Region-specific store                            | 40 – 50               | You know your expected traffic; anonymous traffic is unusual |