> For the complete documentation index, see [llms.txt](https://fulbix.gitbook.io/fulbix-fraud-and-ip-blocker/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://fulbix.gitbook.io/fulbix-fraud-and-ip-blocker/setup/vpn-proxy-and-tor-blocking.md).

# VPN, Proxy & TOR Blocking

### Why Anonymous Traffic Is a Risk

Many fraudsters, carders, and abusers hide their real location and identity by routing their traffic through:

* **VPN services** — mask the real IP with a server in another country
* **Proxy servers** — relay traffic through an intermediary, often shared among many users
* **TOR network** — routes traffic through multiple encrypted relays, making the source nearly untraceable

While some legitimate customers do use VPNs for personal privacy, a large concentration of anonymous traffic — especially combined with suspicious behavior — is a strong indicator of fraud risk.

Fulbix lets you control exactly how to respond to this traffic.

***

### Opening the VPN & Proxy Settings

1. Go to **Security** in the left sidebar.
2. Make sure you are on the **Bot Protection** tab (selected by default).
3. The **Proxy & VPN Blocker** section is at the top of the content area.

***

### Enabling the Blocker

Find the **Anonymous Traffic** toggle and switch it **on**.

Once enabled, three additional settings appear:

1. Risk Score Threshold
2. Block Action
3. Allow iCloud Private Relay

***

### Setting the Risk Score Threshold

The slider controls which visitors get blocked. Drag it left to be more permissive, or right to be more aggressive.

The slider has a color-coded track to guide you:

| Track color | Score range | Risk level | Who it affects                                                                            |
| ----------- | ----------- | ---------- | ----------------------------------------------------------------------------------------- |
| Green       | 0 – 39      | Low        | Likely personal VPN users — privacy-conscious but probably not fraudulent                 |
| Yellow      | 40 – 69     | Medium     | Shared proxies and known anonymizing services — treat with caution                        |
| Red         | 70 – 100    | High       | Known malicious proxies, data-center IPs, TOR exit nodes — likely automated or fraudulent |

The current score value is shown in a colored bubble above the slider thumb. Visitors whose score **meets or exceeds** this number will trigger your chosen block action.

> **Example:** If you set the threshold to 60, any visitor with a score of 60 or higher is blocked or redirected. Visitors with scores below 60 pass through normally.

**Recommended starting point:** Set the threshold to **60–70** for most stores. You can adjust it after reviewing your visitor log data.

***

### Choosing a Block Action

When a visitor's score meets the threshold, you choose what happens:

**Block page** — the visitor sees your custom block page and cannot proceed to your store. Use this when you want to make it clear the visitor has been detected.

**Redirect page** — the visitor is silently forwarded to a URL you specify (must start with `https://`). They do not see a block message. Use this for a quieter response.

If you choose Redirect, a URL field appears below. Enter a valid `https://` URL.

***

### Allow iCloud Private Relay

**iCloud Private Relay** is a privacy feature built into Apple devices for iCloud+ subscribers. It routes Safari traffic through Apple's servers, which means these users will show an Apple-owned IP address — sometimes triggering a moderate risk score.

The **Allow iCloud Private Relay** toggle (on by default) **exempts** these users from VPN blocking so that legitimate iPhone and Mac customers are not affected.

> **Recommendation:** Leave this toggle **on** unless you have a specific reason to block Apple relay traffic. Turning it off risks blocking a meaningful portion of your legitimate mobile customers.

***

### TOR Exit Node Blocking

The **TOR Exit Nodes** toggle is located in the Protection Modules section (below Proxy & VPN Blocker). It is separate from the risk score system.

When enabled, Fulbix blocks any visitor whose traffic arrives from a known TOR exit node, regardless of their risk score.

TOR is legitimate software for privacy advocacy, but it is also heavily used for carding, account takeover, and automated fraud. Blocking TOR exit nodes has **very low false positive risk** for most e-commerce stores.

> **Recommendation:** Keep TOR blocking **on** for all stores.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://fulbix.gitbook.io/fulbix-fraud-and-ip-blocker/setup/vpn-proxy-and-tor-blocking.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.