<<< Back to Documentation

How the Risk is Calculated

The system looks at several factors for each website visit (like a click on a page) and assigns points based on how suspicious they are:

  1. Where the Visit Came From (Referrer Risk):

    • Visits that come directly to the website, or from websites known to be suspicious or unknown, get a higher risk score (10 points).

  2. The "Browser" or Tool Used (User-Agent Risk):

    • If the visitor is using tools or software often associated with automated activity (like bots or scrapers), security testing, or privacy-focused browsers/VPNs, it gets a higher risk score (15 points). This also includes visits with very generic or missing browser information.

  3. The Type of Device (Device Type Risk):

    • Visits from devices identified as "unknown," "bot," "emulator" (software that mimics a real device), or "proxy" (which can hide the real location) get a higher risk score (10 points).

  4. The Visitor's Location (Geo Risk):

    • Visits originating from certain countries that are sometimes associated with high online risk get a higher risk score (12 points).

Aggregating Risk for Each Visitor (Based on IP Address):

The system then groups all the visits from the same internet address (like a digital fingerprint). For each unique internet address, it calculates:

  • Total Initial Risk Score: This is simply the sum of all the risk points from each individual visit associated with that internet address.
  • Time Between Clicks: It looks at how quickly subsequent clicks happen. If clicks occur very rapidly (less than 5 seconds apart), it adds more risk points (7 points), as this can indicate automated behavior.
  • Total Risk Score: This is the initial risk score plus the "repeat click" risk.

Understanding the Final Risk Score:

The "total risk score" is then adjusted to create a "normalized risk score", which is easier to understand. This score is scaled to a range between 0 and 100, where:

  • Higher numbers mean a higher level of suspicion. The system makes sure the score doesn't go above 100.

Based on this normalized score, each internet address is categorized into a "risk category":

  • Low: A normalized risk score below 60.
  • Medium: A normalized risk score between 60 and 79 (inclusive).
  • High: A normalized risk score of 80 or higher.

What the Output Shows:

The final result will only show internet addresses that have been categorized as "Medium" or "High" risk. For each of these risky internet addresses, you'll see:

  • IP Address: The unique digital fingerprint of the visitor.
  • Normalized Risk Score: The scaled risk score (0-100).
  • Risk Category: "Medium" or "High".
  • Number of Clicks: How many times this internet address visited the website.
  • Time Difference: The total time between the very first and the very last click from this address.
  • Types of Devices Used: A list of the different types of devices used during these visits (e.g., desktop, mobile, bot).
  • Referring Websites: A list of the websites that sent traffic from this internet address.
  • Browsers/Tools Used: A list of the different "browsers" or tools used during these visits.
  • Average Time Between Clicks: The average time in milliseconds between each click.
  • Geographic Locations: A list of the unique countries or regions the visits originated from.

In summary, a higher normalized risk score suggests a greater likelihood of suspicious or automated activity coming from a particular internet address, based on a combination of where the visit came from, the tools used, the device type, the location, and the timing of their actions on the website.