Docs menuAll pages, quickstarts and this page’s contents

Docs

Web

Mobile

Android
iOSsoon
React Nativesoon
Fluttersoon

Server

Node.js
PHP
C#/.NETsoon
Go
Javasoon
Python

On this page

The three presets
Setting one
What blocks, signal by signal
The IP signals people confuse
How signals combine
Custom weights and category dials

Sensitivity and what gets blocked

One setting decides how hard Kaidn acts on what it finds. This page says what the three choices do, which signals block on their own under each, and how several signals add up to one verdict.

The tables are generated from the live scoring configuration, so they are the numbers the API is using, not a description of them.

The three presets

A preset moves the two lines a score is compared with: the score at which an event goes to review, and the score at which it becomes block. Everything under the review line is allow. Presets are the one dial available on every plan, including Free.

preset	id	review from	block from	what it does
Strict	`strict`	35	60	Acts harder on what it catches. Blocks VPN, proxy, Tor and datacenter IPs, temporary email and phone numbers, and automated browsers outright. Reviews any IP shared by a second account within 10 minutes, and blocks from the fifth (Apple Private Relay IPs excepted).
Balanceddefault	`balanced`	40	70	The shipped default. Blocks the clear-cut cases and sends the ambiguous middle to review.
Less strict	`lenient`	50	80	Fewest interventions. Cuts the review queue to about a third and blocks only clear cases.

A preset can also raise a few weights, not only the lines. That is why the table further down has a column per preset: the same signal can sit in a different place under each.

Setting one

In the dashboard, open Rules and pick a card. It applies to every event scored from then on, and the page lists what is blocked and what goes to review for your account as configured. Over the API, send the preset id with your secret key:

Terminal

curl -X PUT https://api.kaidn.io/v1/config \
  -H "x-api-key: $KAIDN_API_KEY" \
  -H "content-type: application/json" \
  -d '{"preset":"strict"}'

The preset must be one of strict, balanced, or lenient; anything else is a 400 listing them. GET /v1/config returns your current preset, every preset with its lines, and signals.block, signals.review and signals.contributes for your account as it is configured right now, custom weights included.

PUT /v1/config replaces everything you have stored. Sending only a preset on a paid account that has custom weights, thresholds or category dials removes them. Read your config first and send back what you want to keep, with the preset alongside.

What blocks, signal by signal

Every named signal, against every preset. Read a cell as “if this is the only thing found about an event”:

cell	means
Blocks alone	On its own it reaches the block line. One finding is enough.
Review alone	On its own it reaches the review line, not the block line. A human look, no more.
Only with other signals	It scores something, but not enough to decide anything. It matters only in company.
Scores nothing	Reported as a reason, adds nothing to the score.

One fact about a stranger is rarely enough to convict them, so a signal that decides alone is the exception. The weight column is the score each signal adds on its own under Balanced; where a preset changes it, the cell shows the new weight.

IP intelligence

Where the connection comes from: datacenter, proxy, Tor, known abuse.

Signal	Weight	Strict	Balanced	Less strict
Named VPN (NordVPN, Mullvad...)	75	Blocks alone	Blocks alone	Review alone
Tor exit node	75	Blocks alone	Blocks alone	Review alone
Datacenter / hosting IP	60	Blocks alone	Review alone	Review alone
Proxy IP	40	Blocks aloneweight 60	Review alone	Only with other signals
IP that hit our abuse trap	40	Review alone	Review alone	Only with other signals
Network with a history of abuse	40	Review alone	Review alone	Only with other signals
Apple Private Relay	0	Scores nothing	Scores nothing	Scores nothing

Device reuse

How many other accounts have carried this same fingerprint, and how many of them were on the same network.

Signal	Weight	Strict	Balanced	Less strict
Same device and network on many accounts	55	Review alone	Review alone	Review alone
Device shared by many accounts	45	Review alone	Review alone	Only with other signals
Same device and network on several accounts	40	Review alone	Review alone	Only with other signals
Device shared by several accounts	25	Only with other signals	Only with other signals	Only with other signals
Same device and network on another account	25	Only with other signals	Only with other signals	Only with other signals
Device also used by another account	15	Only with other signals	Only with other signals	Only with other signals

Device integrity

Automation and anti-detect tells: headless, emulated, tampered, spoofed.

Signal	Weight	Strict	Balanced	Less strict
Headless / automated browser	50	Blocks aloneweight 60	Review alone	Review alone
Browser fingerprint APIs tampered with	45	Review alone	Review alone	Only with other signals
Fingerprint noise added (spoofing)	45	Review alone	Review alone	Only with other signals
Browser engine contradicts its user agent	40	Review alone	Review alone	Only with other signals
Emulated or virtual-machine browser	40	Review alone	Review alone	Only with other signals
Connection fingerprint of a known spoofing tool	35	Review alone	Only with other signals	Only with other signals
Browser contradicts itself across contexts	30	Only with other signals	Only with other signals	Only with other signals
Operating system contradicts the user agent	30	Only with other signals	Only with other signals	Only with other signals
Browser claims a different OS than it runs on	25	Only with other signals	Only with other signals	Only with other signals
Tracker call forged by a script	20	Only with other signals	Only with other signals	Only with other signals

Android app integrity

What the phone itself reports: emulator, root, cloning, instrumentation, and hardware that outlived its app identity.

Signal	Weight	Strict	Balanced	Less strict
Android emulator	50	Review alone	Review alone	Review alone
Frida / Xposed instrumentation	50	Review alone	Review alone	Review alone
App-cloning container (Parallel Space...)	45	Review alone	Review alone	Only with other signals
Device reset or re-registered under a new identity	45	Review alone	Review alone	Only with other signals
Failed Google Play Integrity check	45	Review alone	Review alone	Only with other signals
Rooted Android device	40	Review alone	Review alone	Only with other signals
GPS-spoofing app installed	20	Only with other signals	Only with other signals	Only with other signals
App not installed from Google Play	15	Only with other signals	Only with other signals	Only with other signals
Debug build of the app	15	Only with other signals	Only with other signals	Only with other signals
Device clock set ahead	15	Only with other signals	Only with other signals	Only with other signals
VPN switched on in the device	10	Only with other signals	Only with other signals	Only with other signals

Session behaviour

What changed mid-session: a VPN dropping, the IP hopping, impossible travel.

Signal	Weight	Strict	Balanced	Less strict
Browser connection fingerprint changed mid-session	45	Review alone	Review alone	Only with other signals
Impossible travel between countries	40	Review alone	Review alone	Only with other signals
VPN dropped and exposed the real IP	40	Review alone	Review alone	Only with other signals
Started hiding behind a proxy mid-session	30	Only with other signals	Only with other signals	Only with other signals
One device hopping across many IPs	25	Only with other signals	Only with other signals	Only with other signals

Velocity

Bursts of attempts from one IP or device inside the window.

Signal	Weight	Strict	Balanced	Less strict
Burst of events from one IP	75	Blocks aloneweight 65	Blocks alone	Blocks aloneweight 85
Many events from one IP	45	Review aloneweight 40	Review alone	Review aloneweight 55
Burst of events from one device	25	Only with other signals	Only with other signals	Only with other signals

Email integrity

Disposable domains, aliasing, deliverability and mail-host infrastructure.

Signal	Weight	Strict	Balanced	Less strict
Email domain on an abuse list	45	Blocks aloneweight 60	Review alone	Only with other signals
Temporary / disposable email	45	Blocks aloneweight 60	Review alone	Only with other signals
Email domain with no mail server	40	Review alone	Review alone	Only with other signals
Catch-all mail domain	30	Only with other signals	Only with other signals	Only with other signals
Mail server on a generic cloud host	25	Only with other signals	Only with other signals	Only with other signals
Mail server run by a temp-mail service	25	Only with other signals	Only with other signals	Only with other signals
Mistyped email domain (gmail.con)	25	Only with other signals	Only with other signals	Only with other signals
Gibberish email address	20	Only with other signals	Only with other signals	Only with other signals
Malformed email address	20	Only with other signals	Only with other signals	Only with other signals
Email alias trick (dots, googlemail.com)	15	Only with other signals	Only with other signals	Only with other signals
Plus-tagged email (name+tag@)	10	Only with other signals	Only with other signals	Only with other signals

Mailbox reuse

How many accounts share one inbox, counted on the canonical address.

Signal	Weight	Strict	Balanced	Less strict
Same inbox behind many accounts	65	Blocks alone	Review alone	Review alone
Same inbox behind several accounts	55	Review alone	Review alone	Review alone
Same inbox behind another account	45	Review alone	Review alone	Only with other signals

Phone intelligence

Validity, VOIP and virtual lines, carrier, country agreement.

Signal	Weight	Strict	Balanced	Less strict
Temporary SMS number	45	Blocks aloneweight 60	Review alone	Only with other signals
VoIP phone number	40	Blocks aloneweight 60	Review alone	Only with other signals
Invalid phone number	40	Review alone	Review alone	Only with other signals
Phone carrier not a known mobile operator	20	Only with other signals	Only with other signals	Only with other signals
Phone country differs from the IP country	15	Only with other signals	Only with other signals	Only with other signals

Geo mismatch

The stated country against where the network and the clock say you are.

Signal	Weight	Strict	Balanced	Less strict
Browser timezone differs from the IP country	35	Review alone	Only with other signals	Only with other signals
Stated country differs from the IP country	20	Only with other signals	Only with other signals	Only with other signals

Cross-operator graph

Entities other operators on the network have already flagged.

Signal	Weight	Strict	Balanced	Less strict
Flagged by other Kaidn operators	40	Review alone	Review alone	Only with other signals

Signals you do not see here are internal or too quiet to mean anything on their own. They still score; they are just not worth a row. The full list of reason codes is in the API reference.

The IP signals people confuse

Six different facts about a connection get called “VPN” in conversation. They are different findings with different confidence, which is why they are scored differently.

signal	what it actually means	Strict	Balanced	Less strict
Named VPN	The connection leaves from a positively identified consumer VPN: a brand we can name (NordVPN, Mullvad), or a network whose address space is mostly VPN exits. It is a finding, not a guess.	Blocks alone	Blocks alone	Review alone
Proxy IP	The address appears on a proxy list. Those lists are large, merged from many sources and partly out of date, so this says “probably relayed”, not “this is NordVPN”.	Blocks alone	Review alone	Only with other signals
Datacenter IP	The address belongs to a hosting or cloud company rather than a home or a phone. Scripts and tunnels live there; ordinary people rarely sit there on purpose.	Blocks alone	Review alone	Review alone
Tor	The address is a published Tor exit node: a deliberate choice to hide where you are.	Blocks alone	Blocks alone	Review alone
Abusive network	Kaidn’s own data shows this network is mostly fraud. It is not a VPN check and says nothing about a tunnel: it is a statement about the neighbourhood the address lives in. A real person on a mixed network can land here, which is why it is judged against the others.	Review alone	Review alone	Only with other signals
Apple Private Relay	An iCloud+ feature that is on by default for subscribers, so a relay address is almost always an ordinary iPhone or Mac user. It is reported as a reason so you can see it, and it is not penalised.	Scores nothing	Scores nothing	Scores nothing

Two of these are easy to mix up. Named VPN is the high-confidence one: we identified the service. Proxy IP is a list hit, which is weaker evidence. And Abusive network is not about tunnels at all: a person on no VPN, on an ordinary connection, can still share a network that Kaidn has watched produce mostly fraud.

Apple Private Relay is the one that is deliberately never penalised. It is switched on by default for iCloud+ subscribers, so treating it as hiding would flag a large share of honest iPhone and Safari users. If you run geo-locked offers and genuinely need to treat masked origins as risk, a paid account can give it a weight of its own.

How signals combine

Three rules, applied in this order:

Signals that describe the same fact count once. One throwaway domain trips more than one email check; one Tor exit also looks like a hosting address. Within a group only the strongest scores. Every detection is still listed as a reason, so the explanation is complete even though the arithmetic is not inflated.
Different facts add. An anonymous connection plus a throwaway email are two independent pieces of evidence, so their weights sum.
The total is capped at 100, then compared with the two lines of your preset.

The groups that count once together:

Tor exit node, Named VPN (NordVPN, Mullvad...), Proxy IP, Datacenter / hosting IP, Apple Private Relay
IP that hit our abuse trap, Network with a history of abuse
Device also used by another account, Device shared by several accounts, Device shared by many accounts, Same device and network on another account, Same device and network on several accounts, Same device and network on many accounts
Browser fingerprint APIs tampered with, Fingerprint noise added (spoofing), Browser contradicts itself across contexts, Operating system contradicts the user agent, Browser engine contradicts its user agent, Emulated or virtual-machine browser, Connection fingerprint of a known spoofing tool
Android emulator, Rooted Android device, Frida / Xposed instrumentation, Failed Google Play Integrity check
VPN dropped and exposed the real IP, Started hiding behind a proxy mid-session
Many events from one IP, Burst of events from one IP
Temporary / disposable email, Email domain on an abuse list
Email domain with no mail server, Mistyped email domain (gmail.con), Catch-all mail domain, Mail server on a generic cloud host, Mail server run by a temp-mail service
Email alias trick (dots, googlemail.com), Plus-tagged email (name+tag@)
Same inbox behind another account, Same inbox behind several accounts, Same inbox behind many accounts
Gibberish email address, Malformed email address
Temporary SMS number, VoIP phone number
Stated country differs from the IP country, Browser timezone differs from the IP country
On Balanced and Less strict only: a device shared by 3 to 5 accounts on the same network (or 2 to 5 through a replayed device token), and a shared IP. Both say the accounts share a connection, like a family on one tablet, so they count once. Strict adds them, and from 6 accounts on one device they add on every preset.

A worked example

A signup from a Tor exit node, which also reads as a hosting address, using a throwaway email address. Computed from the live configuration:

signal	Strict	Balanced	Less strict
Tor exit node	+75	+75	+75
Datacenter / hosting IP	60, already counted	60, already counted	60, already counted
Temporary / disposable email	+60	+45	+45
Score	100 (sum 135, capped)	100 (sum 120, capped)	100 (sum 120, capped)
Verdict	block	block	block

Scored the way the engine does it: the strongest signal in each group, summed, capped at 100, compared with the review and block lines of each preset.

Custom weights and category dials

Presets are the shipped answer. If your traffic needs a different one, paid plans can go further, in order of how much you should reach for each:

Category dials. One percentage per category (IP, email, device and so on), where 100 is as shipped and 0 switches the category off. The way to say “IP matters more here” once.
Individual weights and thresholds. Advanced: the request has to carry "advanced": true. For when one signal needs a different number.

Your own numbers always win over a preset. A weight you set replaces the preset’s raised weight for that signal, and thresholds you set are applied after the preset’s lines. On Free, the preset is the whole surface; sending weights, thresholds or dials returns a 402 pointing to a paid plan.

The tables on this page show the shipped presets. For your account with everything applied, read signals from GET /v1/config. The wider picture of how a verdict is made is in core concepts.

PreviousCore conceptsHow a verdict is made, in plain words NextAPI referenceEvery endpoint, field and reason code