Signals reference
Every signal Vidar can raise, and roughly how much weight it carries. Positive signals raise risk; a few lower it.
Network
- Tor exit node — connection via the Tor network. High weight.
- Public / residential proxy — IP tied to a proxy service. High weight.
- VPN — commercial VPN provider. Medium weight.
- Datacenter / hosting IP — not a residential ISP; unusual for a normal user. High weight.
- Provider high-risk — the IP intelligence provider rated the address high-risk.
Account
- Account < 24h old / < 7 days — freshly created accounts. High to medium weight.
- Below minimum age — younger than the server's configured minimum.
- No custom avatar — still on a default Discord avatar. Low weight.
- Unverified email — only when your server requires a verified email.
- Reputation badges — HypeSquad, Early Supporter, etc. A reassuring signal that lowers risk.
Link
- Identical device fingerprint — same hashed device as a known member. The strongest link signal, scaled by fingerprint quality.
- Same IP — exact hashed-IP match with another account.
- Same network (/24 or /48) — same network block; weaker, since households and NAT share these.
- Same operator (ASN) — same ISP only; weak on its own.
- Linked to a banned / flagged account — a confident link to a banned account is decisive.
Behavior (raids)
- Join velocity — joins per window versus your baseline.
- Fresh-account cluster — many joining accounts are brand new.
- Shared network / device cluster — many joins from one network or device.
- Username pattern — many joins share a common username base.