Detection & scoring

The model in one paragraph

Each signal contributes a bounded amount of evidence, expressed in log-odds (“bits”). Vidar sums the contributions of the signals that fire, adds a conservative prior, and squashes the total through a logistic function to get a probability, which becomes the 0–100 risk score. Because contributions are bounded, no single heuristic can force a verdict — a confident decision needs several corroborating signals.

Two questions, one score

Vidar evaluates two related things:

• Evasion risk — is this connection trying to hide? (VPN, proxy, Tor, datacenter IP, brand-new account.)
• Identity links — does this account share device/network identifiers with a known member, especially a banned one?

A strong link to a banned account can deny outright (configurable), and hard network policies (e.g. “block Tor”) override the score. Otherwise the score decides.

The decision bands

• Approve — score below your approve threshold (default 35).
• Review — score between the thresholds; held for a moderator.
• Deny — score at/above your deny threshold (default 75), a blocked network type, or a banned-alt match above your confidence line.

Tuning

Raise the approve threshold to be stricter (more members sent to review), or lower the deny threshold to auto-block more aggressively. Toggle whether VPNs, proxies, Tor, and datacenter IPs are blocked outright or merely scored. See the full list of inputs on the signals page.

Failing open

If the IP intelligence provider is unavailable, Vidar scores on the remaining device and account signals rather than blocking everyone. Outages degrade accuracy, never availability.