> For the complete documentation index, see [llms.txt](https://fulbix.gitbook.io/fulbix-fraud-and-ip-blocker/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://fulbix.gitbook.io/fulbix-fraud-and-ip-blocker/setup/risk-score-explained.md).

# Risk Score Explained

### What Is a Risk Score?

Every visitor who arrives at your store is assigned a **Risk Score** — a number from 0 to 100 that represents how likely that visitor is to be using anonymous or fraudulent technology to hide their identity.

**A higher score means a higher chance the visitor is concealing who they are.**

This score comes from **proxycheck.io**, a third-party IP intelligence service that Fulbix queries for every visitor.

proxycheck.io analyzes the visitor's IP address and returns a single 0–100 risk value that already factors in:

* Whether the IP belongs to a known VPN provider
* Whether the IP is a proxy or data-center/hosting address
* Whether the IP is a TOR exit node
* The IP's history of abuse and fraud reports

Fulbix uses this score directly — it is not recalculated or adjusted by Fulbix.

> If proxycheck.io cannot be reached for a request, Fulbix falls back to a risk score from Cloudflare's threat intelligence instead.

***

### Score Bands

Fulbix groups the proxycheck.io score into three bands for display.

Each band is shown with a colored badge in the visitor log.

These bands are Fulbix's own thresholds applied to the score — they are not categories defined by proxycheck.io itself.

| Badge                   | Score range | What it means                                                                                                                                              |
| ----------------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Trusted** (green)     | 0 – 39      | proxycheck.io reports low/no risk for this IP. Likely a regular customer or legitimate user.                                                               |
| **Suspicious** (yellow) | 40 – 74     | proxycheck.io reports moderate risk — possibly a shared proxy or known anonymizing service. Warrants caution but not necessarily a block.                  |
| **Risky** (red)         | 75 – 100    | proxycheck.io reports high risk — typically a known malicious proxy, data-center IP, or TOR exit node. High probability of automated or fraudulent intent. |

***

### What Risk Score Does NOT Tell You

The risk score measures **network anonymization**, not purchase fraud.

A visitor with a score of 80 is very likely hiding their identity — but it does not automatically mean they will place a fraudulent order.

Use the risk score as one signal alongside your Fraud Rules.

#### Example

* A score of 80 + a blacklisted country = high confidence, block immediately
* A score of 45 with normal browsing behavior = review in the visitor log, do not automatically block

***

### Where You See the Risk Score

#### Visitor Log

**Analytics → Visitors**

Every session row shows the risk badge:

* Trusted
* Suspicious
* Risky

#### VPN Blocker

**Security → Bot Protection**

You set a threshold.

Any visitor whose score meets or exceeds that threshold triggers the block action you chose.

See Article 5 for how to configure this.

***

### Recommended Threshold Settings

| Store type                                       | Recommended threshold | Why                                                          |
| ------------------------------------------------ | --------------------- | ------------------------------------------------------------ |
| International store, wide audience               | 70 – 80               | Avoids blocking legitimate privacy-conscious users           |
| High-risk categories (electronics, luxury goods) | 50 – 60               | Stricter — worth accepting some false positives              |
| Region-specific store                            | 40 – 50               | You know your expected traffic; anonymous traffic is unusual |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://fulbix.gitbook.io/fulbix-fraud-and-ip-blocker/setup/risk-score-explained.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.