# User Risk Scoring now catches high-risk browsing with Gateway DNS signals!

Hey everyone, it's me, Shii-chan! Today I found an update that security folks are going to love.

## What was announced?

Over on Cloudflare's Changelog, there's an update to [Risk Score](https://developers.cloudflare.com/cloudflare-one/insights/risk-score/) (User Risk Scoring). Starting now, it pulls direct signals from Gateway DNS traffic patterns, so a user's risk score automatically climbs when they visit high-risk or malicious domains.

## The story so far

Until now, risk scoring had a fairly limited set of signals for judging a user's suspicious behavior. But which sites someone visits is actually a key sign of a possible compromise.

## What changes

By tying Gateway DNS logs to individual users, admins can now spot people interacting with dangerous domains. Here's the nice part: even if a Gateway policy is set to Block the traffic, the interaction is still captured as a "hit." So it's not "we blocked it, all good" — the very attempt to go there shows up in the user's risk profile.

## Dive Deep

Two new risk behaviors are now available in the dashboard:

- **Suspicious Security Domain Visited**: fires when a user visits a domain in the security threats or security risk categories, like malware, phishing, or C2 (command-and-control).
- **High risk domain visited**: fires when a user visits domains categorized as questionable content, violence, or CIPA.

Want the details? Check out the [User Risk Scoring documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/risk-score/).

## Wrap-up

- User Risk Scoring now ingests Gateway DNS signals
- Visiting dangerous domains automatically raises the risk score
- Blocked traffic still counts as an "attempt"
- Two new behaviors: "Suspicious Security Domain Visited" and "High risk domain visited"

If you're a security team running Zero Trust on Cloudflare One, this one quietly makes your visibility a lot sharper!