Suspect Score
A suspect score is a composite risk score, on a 0-to-100 scale, that aggregates bot signals, IP reputation, environment anomalies, and behavioral indicators into a single value. A higher score means the visitor is more likely to be fraudulent or automated.
How Suspect Score works
The suspect score is built by combining several independent evidence streams. Automation signals indicate whether the session looks like a headless browser, an automation framework, or a bot. Network signals draw on IP reputation, including whether traffic comes from a VPN, proxy, Tor, or datacenter. Environment signals flag inconsistencies such as spoofed browser properties or values that do not add up together.
Each stream contributes according to how strongly it predicts abuse, and the weighted result is normalized onto a 0-to-100 range so it is easy to reason about and threshold. Because the score is composite, no single signal dominates: a visitor on a VPN is not automatically condemned, but a VPN combined with automation artifacts and an anomalous environment will push the score high.
The score is computed server-side, where the contributing enrichment cannot be tampered with by the client. This matters because many of the most telling signals, such as IP reputation and cross-request patterns, are precisely the ones an attacker cannot forge from inside the browser.
Why Suspect Score matters for fraud prevention
A single composite number lets a fraud team act quickly and consistently without having to interpret two dozen raw signals per request. The suspect score surfaces coordinated abuse that individual signals would miss on their own, and its 0-to-100 range makes it straightforward to define allow, challenge, and block bands. It is especially valuable against bots, promo abuse, and automated account creation, where multiple weak indicators combine into a strong verdict.
How TRACIO handles it
The Suspect Score is TRACIO's flagship Smart Signal, one of 24 server-computed signals the platform returns. It aggregates bot confidence, IP intelligence, incognito and environment checks, and behavioral indicators into one 0-to-100 value, while still exposing the component signals so teams can see why a score is high and build their own policies on top.
Related terms
Frequently asked questions
Identify every device with confidence
Start with a free plan of 2,500 API calls per month. No credit card required.