How to read a risk signal
Risk Signals: How to read a risk signal
When you open the description of a signal, you will usually see the following message:
| Information | How to help you |
|---|---|
| Signal Code | Accurately locate this signal in event details, Server API and logs |
| Display name | Quickly understand the risk represented by the signal |
| English name | Used when communicating with API, R&D logs or overseas teams |
| Risk Classification | Determine whether it is a device, network, client or bot risk |
| Risk Level | Understand the level of risk this signal typically corresponds to |
| confidence | Understand the statistical credibility of this test result |
| Supported Platforms | Confirm if it works for Web, iOS, Android, or Mini Programs |
| Trigger conditions | Understand the circumstances under which this signal may occur |
| Special circumstances | Understand possible normal business explanations or misjudgment scenarios |
| Disposal recommendations | Reference when choosing observation, verification, restriction or blocking methods |
Support platforms and instructions may vary for different signals. If a signal does not appear in the events of the current platform, it does not mean that the access failed. It may just be that the platform does not provide the corresponding detection capability.
Find signals by category
The risk signals page organizes signals by category, allowing you to start investigating from device, network, client, and other risk directions. Common categories and representative signals are listed below:
| Risk Category | Category | Representative Signal Code | What it usually means |
|---|---|---|---|
| Illegal package name | Illegal Parameters | INVALID_PACKAGE | Package name or signature tampering detected |
| Request Replay | Request Replay | TOKEN_EXPIRED | Token has expired or been reused |
| Exceed the limit | Exceed the limit | LIMIT_EXCEED | The request exceeds the configured limit |
| Emulator | Emulator | EMULATOR | The device runs in a traditional simulator environment |
| Emulator | Emulator | CLOUD_PHONE | The device runs in a cloud phone or ARM service device environment |
| Emulator | Emulator | RUNNING_ON_MACOS | Mobile applications run in a macOS compatible environment |
| Risk tool | Risk tool | TAMPER_TOOL_INSTALLED | The device has a modification or tampering tool installed |
| Risk tool | Risk tool | RUNNING_IN_VIRTUAL_MACHINE | The device runs in a virtual machine environment |
| Risk tool | Risk tool | USING_DEVICE_TAMPERING_TOOL | The current device is using the modification risk tool |
| Tamper risk | Tamper | HOOK_TAMPERING_HIGH | Higher risk code hook or tampering detected |
| Debugging | Debugger | BEING_DEBUGGED | The device is being debugged, which may affect the identification results |
| Anti-fraud environment | Anti-fraud | SCREEN_SHARING | The device is sharing screen |
| Network environment risks | Network anomaly | VPN_ENABLED | Device accessed through VPN network |
| Network environment risks | Network anomaly | NETWORK_PROXY | The device is accessed through a network proxy |
| System environment risk | Device environment abnormal | DEVICE_JAILBREAK | iOS devices are jailbroken |
| System environment risk | Device environment abnormal | DEVICE_ROOTED | Android or HarmonyOS device has root behavior |
| System environment risk | Device environment abnormal | BROWSER_INCOGNITO_MODE | Browser is in private or incognito mode |
| blocklist | blocklist | WHITELIST_ACCOUNT_ID | Account hits blacklist or list rules |
| Network anomaly | Network anomaly | IP_MALICIOUS_ATTACK | IP has malicious attacks |
| allowlist | allowlist | BLACKLIST_IP | IP hits allowed or whitelist rules, the specific meaning is subject to the configuration instructions |
After opening a specific signal in the console, you can view its full name, supported platforms, trigger instructions, and special conditions.
How to understand disposal recommendations
The disposition suggestions in the signal details are used to help you develop business rules. Common values include:
- Passed: The current signal can be passed, but can still be recorded and observed.
- Through observation: It is recommended to adopt flexible measures such as verification code, frequency limit, delayed rights or manual review.
- Deny: When the risk is high, you can limit the current request or enter the blocking process.
These suggestions do not automatically perform the final action for you. You still need to combine account, order, device history, other signals and miscalculation costs to determine the actual treatment.
For example, VPN_ENABLED may appear during normal privacy-oriented browsing and is suitable for observation alongside business context. EMULATOR, DEVICE_ROOTED, and high-risk tampering signals may require stricter verification for payments or withdrawals. The appropriate handling depends on your business.
How to understand special situation instructions
Some signals have special situation descriptions to remind you not to deal with them directly without leaving the business scenario. For example:
- Cloud phones and simulators may be risk environments, or they may be enterprise tests, compatibility tests or specific business scenarios.
- VPN, proxy and privacy modes may be normal user behavior.
- Screen sharing, voice calls, or remote assistance may reasonably occur in customer service, meetings, or accessibility scenarios.
- Unavailability of browser cookies does not necessarily indicate malicious intent and may be caused by user privacy settings.
If your business is sensitive to mis-blocking, it is recommended to use "observation" or enhanced verification first, and continue to observe through event and visitor history.