Example

[email protected]disposable detectedBlocked
[email protected]Gmail variant recognisedOffer denied
[email protected]healthy addressGranted
[email protected]privacy relayOffer pending
[email protected]disposable detectedBlocked
[email protected]healthy addressGranted
[email protected]duplicate recognisedOffer denied
[email protected]disposable detectedBlocked

Promo abuse protection

Stop fake signups before they cost you.

Ksar detects disposable emails and duplicate accounts at signup, and protects your promo offers (discount codes, free trials, free credits).

Start for free Request an audit

What Ksar detects

Disposable emails
Duplicate accounts
Gmail variants
Privacy relays
Suspicious domains

No credit card · Hosted in the EU

The demo in 3 steps

Risk score0 / 100

Same person as a previous signup (dots, +alias)

Signup: Accepted
Promo offer: Denied

€10 discount protected

Recognised as: [email protected]

Gmail ignores capital letters, dots (claire.martin = clairemartin) and everything after the +. These addresses all land in the same inbox: Ksar recognises the same person.

Real API · a sandbox just for you, erased after 24 hours.

The gate

Every signup goes through the gate.

Ksar stands at the entrance of your signup form: disposable addresses stay outside, variants of the same person come together, real signups get through.

Disposable: signup blocked
Variants: one person, promo offer denied
Healthy address: promo offer granted

ExampleFictional examples · made-up addresses

Our real numbers

97,308
known disposable domains: 29
disposable mail servers tracked: 1× / day
list updates: ≤ 40 ms
measured response time

open list, counted when the site is published · to recognise new domains of the same service · automatic daily job · p97.5 in our load test, 50 concurrent connections

Decision log

Example

[email protected] · disposable detectedBlocked
[email protected] · Gmail variant recognisedOffer denied
[email protected] · healthy addressGranted
[email protected] · first signupGranted
[email protected] · disposable detectedBlocked
[email protected] · healthy addressGranted

One promo offer per person

One promo offer per real person, not per email address.

Creating a new address isn’t enough to fool Ksar when it’s a variant or a duplicate, and more signals are on the way to make abuse even less worthwhile.

Fictional examples · made-up addresses

[email protected]First signup
[email protected]Capital letters
[email protected]Without the dots
[email protected]+promo

One single person

Recognised as

clairemartin@gmail.com

Promo offer

Denied

Already granted to this person.

Available today

Address variants
Capital letters, Gmail dots, +promo: one inbox, so one person.
Duplicate accounts
Someone who signs up again is recognised: their promo offer isn’t granted twice.
Address series
john1, john2, john3…: addresses created in bulk are flagged as a series.

Coming soon: more signals that are harder to multiply

Payment cardSoon
Phone numberSoon
Shipping addressSoon
DeviceSoon

No detection is perfect: the goal is to make abuse rare and not worth the effort.

Use cases

A ready-to-use decision, for every offer.

Your server sends the address, Ksar answers in JSON: block the signup, grant, hold or deny the promo offer.

E-commerce promo code
Free credits (AI)
Audit your user base

One welcome discount per customer, not one per fake address.

Your AI credits for real users, not for disposable accounts.

How much your promo offers have already cost you, from a simple CSV.

RequestExample

POST /v1/check-email
x-api-key: $KSAR_API_KEY

{ "email": "[email protected]", "event": "signup", "offer": "welcome_10" }

Response 200 OK

{  "normalized_email": "[email protected]",  "risk_score": 0,  "block": false,  "duplicate": {    "status": "exact",    "count": 2  },  "offer": {    "decision": "deny",    "reasons": [      "duplicate_exact"    ]  }}

SignupAcceptedPromo offerDenied

€10 discount not granted twice

Fictional example: addresses and numbers made up for illustration.Learn more →

RequestExample

POST /v1/check-email
x-api-key: $KSAR_API_KEY

{ "email": "[email protected]", "event": "signup", "offer": "free_credits" }

Response 200 OK

{  "normalized_email": "[email protected]",  "risk_score": 90,  "block": true,  "reasons": [    "disposable_domain"  ],  "offer": {    "decision": "deny",    "reasons": [      "disposable_domain"    ]  }}

SignupBlockedPromo offerDenied

€5 of AI credits kept for a real user

Fictional example: addresses and numbers made up for illustration.Learn more →

Audit report · KsarExample

10,000 signups analysed

Disposable addresses620 · 6.2%
Duplicates and variants380 · 3.8%
Privacy relays110 · 1.1%
Healthy addresses8,890 · 88.9%

Estimated total lost

€10,000

(disposable + duplicates) × €10 promo offer

Run the free audit

Fictional example: addresses and numbers made up for illustration.

The hidden cost

You are losing money without seeing it.

Every fake account costs something: a discount, credits, emails sent. Ksar lets you keep it.

Reused promo codes

The same customer uses 10% off again and again with fake addresses. The discount eats your margin: the sale earns less, sometimes nothing.

Abused trials and credits

Every fake account burns servers or AI credits that cost you real money, without ever becoming a customer.

Fake accounts

Skewed analytics, emails sent to dead addresses, damaged sender reputation: your decisions rely on bad data.

Ksar stops promo abuse at signup: you keep your margins, your credits and your real data.

Calculator

How much are you losing every month?

An estimate in 10 seconds with your own numbers.

Estimated loss per month

—

that is, per year —

: —
Estimated net savings: —

Calculate your real loss with your data

Indicative estimate: signups × share of abuse × promo offer value. Prices exclude tax.

Transparency

Our method, fully transparent.

No black box: here is what Ksar checks, what it does not keep, and what it cannot do (yet).

What we check

Syntax and domain: lists of disposable domains, updated every day.
Mail servers (MX): a new domain of a known disposable service is recognised.
Address variants: uppercase, Gmail dots, “+” aliases.
Duplicates and series (jean1, jean2, jean3…), within your own signups only.
Privacy relays (Apple, Firefox, DuckDuckGo…).
Domain age and catch-all domains, in the background.

What we do not store

No email address in clear text: only encrypted fingerprints (HMAC), specific to each customer.
No IP address of your visitors: your server is the one calling the API.
Fingerprints are purged automatically and can be erased on request (right to erasure).

Our limits, honestly

A brand-new disposable service may get through until the next update, unless its mail server is already known.
A second mailbox created from scratch, unrelated to the first one, is not recognised yet: more signals are coming.
Domain age and catch-all are checked in the background: the very first signup from an unknown domain does not benefit from them.
If our API does not answer, your signups still go through: better to let one abuse pass than to block a customer.

Hosted in the EU: The API and the database are hosted in the European Union.
No clear-text addresses: Addresses are analysed in memory, then kept only as encrypted fingerprints.
Erasure on request: One request erases every trace of a person (right to erasure).
Never blocking: If the API does not respond, your signups keep going: your form never goes down.

Read the data processing agreement (DPA)

Works with

One request from your server.

A REST API and a readable JSON response: any language that can make an HTTP request works. Documentation, examples and sandbox included.

API RESTJSON response, documented reason codes
Node.jsServer-side call, a few lines
PythonServer-side call, a few lines
PHPServer-side call, a few lines
StripeDecide before creating the promo code
ShopifySoon
WooCommerceSoon
PrestaShopSoon

Read the documentation

curl -X POST https://api.useksar.com/v1/check-email \
  -H "x-api-key: $KSAR_API_KEY" \
  -H "content-type: application/json" \
  -d '{"email":"[email protected]","event":"signup","offer":"welcome_discount"}'

const res = await fetch('https://api.useksar.com/v1/check-email', {
  method: 'POST',
  headers: { 'x-api-key': process.env.KSAR_API_KEY, 'content-type': 'application/json' },
  body: JSON.stringify({ email, event: 'signup', offer: 'welcome_discount' }),
});
const { block, offer } = await res.json();

r = requests.post("https://api.useksar.com/v1/check-email",
    headers={"x-api-key": os.environ["KSAR_API_KEY"]},
    json={"email": email, "event": "signup", "offer": "welcome_discount"}, timeout=2)
decision = r.json()["offer"]["decision"]

$ch = curl_init('https://api.useksar.com/v1/check-email');
curl_setopt_array($ch, [CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ['x-api-key: ' . getenv('KSAR_API_KEY'), 'content-type: application/json'],
  CURLOPT_POSTFIELDS => json_encode(['email' => $email, 'event' => 'signup'])]);
$result = json_decode(curl_exec($ch), true);

200 OK

{
  "block": false,
  "risk_score": 6,
  "duplicate": { "status": "exact", "count": 2 },
  "offer": { "decision": "deny", "reasons": ["duplicate_exact"] }
}

01
The form
A visitor signs up: their email reaches your server.
02
Your server calls Ksar
In under 50 ms: disposable, duplicate, alias, abuse risk.
03
You decide
Accept, block, or deny only the promo offer.

Pricing

Start free, pay as you grow.

14-day Pro trial, no credit card. Prices exclude tax, per month.

Free

200 checks / month

Full disposable detection

Get started

Starter

€9/ month

2,000 checks / month

+ per-customer rules

Get started

Recommended

Pro

€39/ month

20,000 checks / month

+ promo offer protection

Get started

Business

€129/ month

150,000 checks / month

+ CSV audit, priority support

Get started

Enterprise

Custom

Custom volume

Contract, volume and onboarding

See plan details

Ready to close the gate?

Protect your signups today.

Free API key right away, no credit card. Or ask us to audit your signups.

Start for free Request an audit

Stop fake signups before they cost you.

Every signup goes through the gate.

One promo offer per real person, not per email address.

Address variants

Duplicate accounts

Address series

A ready-to-use decision, for every offer.

You are losing money without seeing it.

Reused promo codes

Abused trials and credits

Fake accounts

How much are you losing every month?

Our method, fully transparent.

What we check

What we do not store

Our limits, honestly

One request from your server.

The form

Your server calls Ksar

You decide

Start free, pay as you grow.

Free

Starter

Pro

Business

Enterprise

Protect your signups today.