Skip to main content

iClosed Shield

Protect your calendar from bots, spoofers, and fraudulent bookings by screening every booking-page visitor with iClosed's device and network fingerprinting

iClosed Shield is a built-in security feature that automatically fingerprints every visitor on your public booking page and returns real-time risk and integrity signals, before a call is ever booked.

Instead of trusting every visitor equally, iClosed enriches each contact with security signals (such as VPN use, location spoofing, emulator/bot detection, and browser integrity) that you can act on.

Shield is one of the iClosed Data Intelligence features which signals can be used for:

  • Disqualifying leads that trip your risk criteria (e.g. VPN + location spoofing), or

  • Conditional routing logic to send suspicious-but-allowed visitors to the right handling

⭐ Shield is available on all plans for Disqualification, but Conditional routing on Shield fields requires the Business plan (Startup and Growth can disqualify on Shield signals, but not route on them). See the full feature and pricing breakdown here.


How Does It Work

Shield fingerprints the visitor's device and network the moment they land on your public booking page, and returns a set of security signals that describe how trustworthy the session is.

For example whether the visitor is on a VPN or proxy, whether their location appears spoofed, whether the session looks like an emulator or bot, and browser/OS integrity details. Those signals become available as criteria inside Disqualification and Conditional Routing, so a visitor can be blocked or routed based on what Shield returns.

Pro Tips

Shield works with no disqualification and conditional routing applied, so we advise you to enable it first, analyze pattern and then disqualify or route to a specific host.

Never block based on just 1–2 leads, but look for a repeated pattern (same email/name pattern across 7–8 bookings, same proxy + country combo).

This way you will prevent blocking the real leads.


When Shield will run

Shield only runs when it is enabled at both levels:

  1. Account level — Shield is turned on for your workspace under Data Intelligence, and

  2. Event level — Shield is toggled on for the specific event.

If the account toggle is off, the event toggle can't be used. If the account is on but the event is off, Shield does not run for that event and no credits are spent, so the visitors will be able to book calls as per other event conditions.


When Shield is unavailable

If Shield cannot return a result, the check is treated as unavailable. The following all count as unavailable:

  • The provider is blocked or unreachable

  • The check times out

  • The feature otherwise can't run

  • Your wallet is empty (no credits/tokens available)

You control what happens in this case with a "Disqualify when Shield is unavailable" checkbox.

When it's off, the booking is allowed to complete even if Shield didn't run, so a visitor is never falsely disqualified. When it's on, a visitor is disqualified whenever Shield can't produce a result.

Pro Tips

Shield can also be managed from the Settings → Integrations page.

Shield must be enabled at the account level before the event-level toggle becomes usable. If the toggle appears disabled, enable Shield for your workspace under Data Intelligence first.


Enrichment Requirements

For Shield to run and return signals:

  • Shield is enabled at both the account and event level

  • The visitor has loaded your public booking page (Shield fingerprints the session on the page)

  • Credits/tokens are available in the wallet


Setting it up

Shield is enabled from the event's Data Intelligence section, the same place as the other enrichment features.

  1. Navigate to AI Scheduler → Events and click the event to open its setup

  2. Select the Data Intelligence section in the left-side menu

  3. Click "Browse Enrichment", select iClosed Shield, and turn the toggle ON

After the Shield is turned on, navigate to Disqualification or Conditional routing section for further configuration:

  • Disqualifying leads that trip your risk criteria (e.g. VPN + location spoofing) along with option to enable "Disqualify when Shield is unavailable" if you want visitors blocked whenever Shield can't return a result

  • Conditional routing logic to send suspicious-but-allowed visitors to the right handling

Set conditions and confirm by pressing "Save Changes"

Pro Tips

  • Shield screens every visitor on the public booking page, so it works alongside your form questions, not just after the form is completed.

  • Keep wallet auto-recharge ON so Shield isn't interrupted mid-campaign (an empty wallet counts as "unavailable").


Shield Signals

Shield returns a set of security and device-integrity signals for each visitor. Each signal is a different way of asking the same underlying question:

is this a genuine prospect, or someone trying to slip a bot, a spoofed device, or a hidden identity past your booking page?

Every signal is available as a criterion in Disqualification and Conditional Routing, as a column and advanced filter in Global Data, and on the contact card's Fingerprint tab.

The signals fall into a few natural groups. Most are simple Yes / No flags, a few return levels (Low / Medium / High) or a small set of categories. Here's the breakdown:


Identity & session context

These describe who and what is on the page.

They're rarely a reason to block on their own, but they're the context you combine with risk flags.

Signal

Values

What it means / defends against

Browser name

Safari, Mobile Safari, Chrome, Mobile Chrome, Firefox, Mobile Firefox, Brave, Opera

The browser the visitor is using. Useful for routing and for spotting odd combinations (e.g. an automation-friendly browser paired with other risk flags).

User Device OS

Windows, Mac OS X, Linux, Android, iOS

The operating system of the visitor's device. Server/automation setups often surface as Linux where you'd expect consumer OSes.

User Device Country Code

Any country (searchable, grouped by continent)

The country the device reports. Compare against the visitor's stated location or your target market.

Continent code

AF, AN, AS, EU, NA, OC, SA

The continent of the device. A coarser version of country code, handy for broad routing or filtering.

Visitor found

Yes / No

Whether Shield recognized this visitor's fingerprint. "No" means a brand-new/unseen device.

High activity

Yes / No

Whether this visitor's fingerprint has been unusually active (many sessions/bookings in a short window) — a sign of scripted or repeat abuse.


Overall risk scores

These are Shield's summarized verdicts — the quickest single signals to build rules on.

Signal

Values

What it means / defends against

Confidence score

Low (< 0.5)

Medium (0.5 to < 0.8)

High (≥ 0.8)

Shield's overall confidence that the visitor is genuine. This is an internal health-scoring system that weighs many device and network factors in the background to identify bad actors. Higher = more trustworthy.

Suspect score

Yes / No

An internal flag raised when the visitor's session looks suspicious across Shield's combined checks. A quick "this one is off" indicator.

Bot result

Not detected, Good, Bad

Whether the session appears automated. "Bad" indicates a likely malicious bot, "Good" indicates a known benign bot and "Not detected" means it looks human. Your first line of defense against scripted spam bookings.


Network & location integrity

These catch visitors hiding or faking where they're really connecting from the classic toolkit of spammers and fraudulent bookers.

Signal

Values

What it means / defends against

VPN detected

Yes / No

The visitor is connecting through a VPN, masking their true network/location.

VPN confidence

Low / Medium / High

How certain Shield is that a VPN is in use. Pair with VPN detected to avoid acting on weak signals.

Proxy detected

Yes / No

The visitor is routing through a proxy server to obscure their origin.

Proxy confidence

Low / Medium / High

How certain Shield is that a proxy is in use.

Proxy type

Residential, Data center, Unknown

The kind of proxy. Data center proxies are a strong automation/fraud signal; residential proxies are commonly used to look like ordinary home users.

Tor detected

Yes / No

The visitor is on the Tor anonymity network - a heavy anonymization signal rarely seen from genuine buyers.

Location spoofing

Yes / No

The device's reported location appears falsified (e.g. GPS/timezone manipulation).

IP blocklist

Blocked / Not blocked

The visitor's IP address appears on a known-bad blocklist.

Email spam (blocklist)

Yes / No

The email is associated with spam/abuse blocklists.

Attack source (blocklist)

Yes / No

The IP/source is associated with known attack infrastructure.


Device tampering & automation

These detect environments built to fake, script, or manipulate a real device. This is the deepest layer of defense against sophisticated bad actors.

Signal

Values

What it means / defends against

Emulator detected

Yes / No

The "device" is a software emulator rather than a real phone/computer — a hallmark of automated fraud farms.

Virtual machine

Yes / No

The session runs inside a virtual machine rather than a physical device.

Cloned app

Yes / No

The booking app/page is running as a cloned/duplicated instance, often used to run many fake sessions.

Anti-detect browser

Yes / No

A specialized browser designed to defeat fingerprinting and impersonate many different users. Almost exclusively used by bad actors.

Tampering detected

Yes / No

The device/session shows signs of manipulation.

Tampering anomaly score

Less than 0.5, Greater than or equal to 0.5

A graded measure of how much tampering is detected. ≥ 0.5 = significant tampering.

Root apps detected

Yes / No

The (Android) device has root/superuser apps installed, giving the user deep control to manipulate the environment.

Jailbroken

Yes / No

The (iOS) device is jailbroken, removing manufacturer restrictions and enabling tampering.

Frida detected

Yes / No

The Frida instrumentation toolkit is present — a developer tool used to hook into and manipulate apps at runtime. A strong technical-abuse signal.

Developer tools

Yes / No

Browser developer tools are open during the session.

Incognito

Yes / No

The visitor is in private/incognito browsing mode.

Privacy settings

Yes / No

The browser is in a hardened/restricted privacy state that limits what can be read about the session.

MITM attack

Yes / No

A man-in-the-middle attack is detected on the connection, meaning traffic may be intercepted.

Important Notes

The signals available in your account may expand over time as Shield's detection capabilities grow.

If a signal appears in your event's dropdown but not above, treat its label literally. Most are Yes / No flags where Yes means the risk condition is present.


Credits used per Shield check

Shield is a usage-based feature billed from your iClosed wallet. You only pay when a check actually runs.

  • iClosed Shield = $0.20 (1 token) per check

Shield charges once per potential contact and then caches the result for 7 days.

If the same visitor returns within that window, Shield reuses the cached result and does not charge again. A visitor is re-checked (and charged again) only when:

  • The 7-day cache window lapses, or

  • The cache is cleared (e.g. browser data cleared), or

  • The visitor's device changes

Pro Tips

  • Have wallet auto-recharge turned ON so Shield is never interrupted. An empty wallet will be treated as "unavailable."

  • Because results are cached for 7 days, high-traffic events won't be charged repeatedly for the same returning visitor.


Analyzing Shield Results

Shield Logs

The Shield logs page provides an audit trail of every Shield check in your workspace.

For each check you'll typically see the contact, the result (success / failed / cached), credits or tokens consumed, and the timestamp.

Shield also appears as its own line in the credits usage breakdown, and clicking it opens the feature-specific logs.

This is the system-level and billing-level view, ideal for monitoring usage and cost, debugging failed or unavailable checks, and confirming cache behavior.


Global Data

Shield signals are available as Global Data columns and advanced filters, so you can segment and build Smart Views across your leads — for example "Booked on VPN," "Location spoofed," or "Disqualified by Shield."

This is the strategy and optimization view, where patterns live in table view.


Contact Card - Fingerprint tab

The Contact Card includes a Fingerprint tab showing all Shield signals for that specific visitor, and Shield events appear in the contact's journey timeline (success/failure, credits used, and whether the result was served from cache).

This is the decision-making view, optimized for setters and closers during a call.


Shield fields are also surfaced on pipeline cards and are available in Zapier/Make, so downstream automations can act on Shield signals.


Shield with iClosed Disqualification & Conditional Routing

Shield with iClosed Disqualification

Disqualification on Shield signals is available if Shield is turned ON in the Event – Data Intelligence section, and applies once Shield returns a result for the visitor (or, if you've enabled it, when Shield is unavailable).

All visitors that meet your criteria will be disqualified as per the Disqualification rules set in your event. Because Shield screens the visitor on page load, it can block a suspicious visitor before they ever take a slot on your calendar — which is the whole point of the feature: keeping bots, spammers, and fraudulent bookers off your closers' schedules.

Disqualification is available on all plans, including Startup and Growth.

Think of Shield disqualification in three tiers of severity:

Hard block (near-certain bad actors)

These signals almost never come from a real buyer, so a single "Yes" is usually enough to disqualify:

  • Bot result is Bad

  • Emulator detected, Virtual machine, Cloned app, or Anti-detect browser is Yes

  • Frida detected, Root apps detected, or Jailbroken is Yes

  • Tor detected is Yes

  • MITM attack is Yes

  • Attack source (blocklist) or IP blocklist is Blocked

  • Tampering detected is Yes / Tampering anomaly score ≥ 0.5

Soft block or review (suspicious, but not always malicious)

These are better used in combination (see Best Practices) or to redirect rather than hard-block, since legitimate people sometimes trip them:

  • VPN detected is Yes with VPN confidence High

  • Proxy detected is Yes with Proxy type Data center

  • Location spoofing is Yes

  • Confidence score is Low

  • Suspect score is Yes

  • High activity is Yes

  • Email spam (blocklist) is Yes

Shield unavailable fallback option

Use the "Disqualify when Shield is unavailable" checkbox if you'd rather fail closed than let unscreened visitors book (remember an empty wallet counts as unavailable).

Learn More about Invitee Disqualification & Redirection for how to build disqualification conditions.


Shield with iClosed Conditional Routing

Conditional routing on Shield signals is available if Shield is turned ON in the Event – Data Intelligence section, and applies once Shield returns a result for the visitor.

All visitors that meet your criteria will be routed to specific closers as per the Conditional Routing rules set in your event. Routing is the softer companion to disqualification: instead of blocking a flagged-but-allowed visitor, you send them somewhere appropriate.

Conditional routing on Shield fields requires the Business plan. On Startup and Growth, Shield signals are available for disqualification but not for routing.

Common ways teams route on Shield signals:

  • Clean, high-trust sessions (Confidence score High, no VPN/proxy, Bot result Not detected) → route to your best closers, since these are your most legitimate prospects.

  • Flagged-but-allowed sessions (e.g. VPN detected Yes but Confidence score Medium/High) → route to a senior rep or a verification step, so someone experienced can confirm identity on the call rather than turning the lead away outright.

  • Geographic routing (User Device Country Code or Continent code) → route by real device location to the right regional team, independent of what the visitor typed on the form.

  • Device-based routing (User Device OS or Browser name) → e.g. send mobile visitors to reps who specialize in mobile-first conversations.

Learn more about Conditional Routing for how to build routing conditions.


Best Practices - Combining Signals

No single signal tells the whole story. Real buyers occasionally trip one flag (a privacy-conscious user on a VPN, someone in incognito mode), while sophisticated bad actors try to look clean on the surface.

The reliable approach is to cross-check signals — look for a risk flag confirmed by a second, independent one before you block.

The rule of thumb:

  • one soft signal = watch;

  • two independent soft signals = act.

Hard signals (emulator, Frida, cloned app, MITM, anti-detect browser) can stand alone.


High-confidence bad-actor combinations

These pairings rarely occur together for a genuine buyer, so they make strong disqualification rules:

Combination

Why it's a strong signal

VPN detected = Yes AND VPN confidence = High

A confirmed VPN (not a weak guess). Someone deliberately masking their network.

Proxy detected = Yes AND Proxy type = Data center

Data-center proxies are for servers and automation, not home users. Classic bot infrastructure.

Location spoofing = Yes AND VPN/Proxy = Yes

Faking location and masking the network — deliberate concealment, not coincidence.

Confidence score = Low AND Suspect score = Yes

Shield's two summary verdicts agreeing that the session is off.

Bot result = Bad AND High activity = Yes

An automated session that's also hammering your scheduler — a spam run in progress.

Emulator detected = Yes AND User Device OS = Android/iOS

A "mobile" visitor whose device is actually emulated — a fake device pretending to be a phone.

Incognito = Yes AND Developer tools = Yes AND Confidence score = Low

Private browsing plus open dev tools plus a low trust score — a tinkerer probing your page, not a buyer.

Tampering detected = Yes AND Tampering anomaly score ≥ 0.5

The flag is confirmed by the graded score, so it's significant manipulation, not noise.

Signals that are safe to act on alone

These are strong enough that a single "Yes" justifies a hard block, because they almost never appear for legitimate visitors:

  • Frida detected, Cloned app, Anti-detect browser, MITM attack

  • Attack source (blocklist), IP blocklist = Blocked

  • Bot result = Bad

  • Root apps detected / Jailbroken (use with a little more care — some power users root/jailbreak their own devices; pair with another signal if you serve a technical audience)


Signals to use as context, not as a block by themselves

These are common enough among real people that blocking on them alone will cost you good leads. Use them to confirm another flag, or to route rather than disqualify:

  • Incognito, Privacy settings, Developer tools — privacy-conscious real users trip these constantly.

  • VPN detected (alone, low/medium confidence) — plenty of legitimate people always run a VPN.

  • Browser name, User Device OS, Continent code — descriptive context, best for routing.


Worked example — a balanced starter policy

A sensible starting configuration for a high-ticket scheduler:

  1. Hard-disqualify if any of:

    1. Bot result = Bad

    2. Emulator = Yes

    3. Virtual machine = Yes

    4. Cloned app = Yes

    5. Anti-detect browser = Yes

    6. Frida = Yes

    7. MITM attack = Yes

    8. Attack source = Yes

    9. IP blocklist = Blocked.

  2. Disqualify on confirmed concealment:

    1. VPN detected = Yes AND VPN confidence = High or

    2. Proxy type = Data center or

    3. Location spoofing = Yes AND (VPN = Yes OR Proxy = Yes)

  3. Disqualify on agreeing summary scores:

    1. Confidence score = Low AND Suspect score = Yes

  4. Route, don't block:

    1. VPN detected = Yes with Confidence score = Medium/High → send to a senior rep for a quick identity check.

  5. Leave everything else to book normally, so you don't sacrifice genuine leads to over-aggressive filtering.


Pro Tips

If you recognize "a real lead got blocked," check the Fingerprint tab on that contact. Usually it's a single soft signal (VPN or incognito) being used as a standalone hard block, and the fix is to require a second confirming signal, per the cross-check approach above.


Shield with Multi-Booking

Shield does not change the logic of the Multi-Booking feature.

The event's Disqualification or Conditional Routing conditions take priority when turned on.


FAQs

Where can I see usage for my Shield checks?

Shield usage appears as its own line in the tokens/credits usage breakdown, and clicking it opens the Shield logs with per-check results, credits/tokens consumed, and timestamps.


What happens if I don't have enough credits in my wallet?

An empty wallet counts as Shield being unavailable. If "Disqualify when Shield is unavailable" is off, bookings still complete (without a Shield result); if it's on, visitors are disqualified until the wallet is topped up.

Turn on auto-recharge in Settings → Billing to avoid interruptions.


Will the same visitor be charged every time they visit?

No. Shield charges once per visitor and caches the result for 7 days.

Within that window a returning visitor reuses the cached result at no additional charge. A re-check (and new charge) only happens if the 7-day window lapses, the cache is cleared, or the visitor's device changes.


Does Shield work on all booking pages?

Shield screens visitors on your public booking page, including Lift.

It runs when enabled at both the account and event level.


What is Shield actually protecting me from?

Bots, spammers, and fraudulent bookers.

Shield fingerprints each visitor's device and network to spot the tools bad actors use to fake being a real prospect — automated bots, emulators and virtual machines, VPNs/proxies and Tor, spoofed locations, tampered or jailbroken devices, and known-bad IPs.

You can then block those sessions before they take a slot on your closers' calendars.


What is the Confidence score, exactly?

It's Shield's overall internal health-scoring system. Behind the scenes it weighs many device and network factors together to judge how likely the visitor is to be genuine.

It's expressed as Low (< 0.5), Medium (0.5 to < 0.8), or High (≥ 0.8) — higher means more trustworthy.

Use it as a quick summary signal, ideally cross-checked with Suspect score or Bot result.


A real lead got disqualified by Shield — why?

Almost always this is a single "soft" signal being used as a standalone block — most often VPN detected, Incognito, or Privacy settings, all of which privacy-conscious real people trigger routinely.

Open that contact's Fingerprint tab to see which signal fired. The fix is to require a second, confirming signal before disqualifying (see Best Practices — Combining Signals) rather than blocking on one soft flag alone.


Do "Yes" and "High" mean risky?

For the Yes/No flags, Yes means the risk condition is present (e.g. VPN detected = Yes means a VPN is in use).

For the confidence-style levels it depends on the signal: for VPN confidence / Proxy confidence, High means Shield is very sure that VPN/proxy is present (riskier).

But for the overall Confidence score, High means the visitor is very likely genuine (safer).

When in doubt, check the Shield Signals table above.


What are the priority signals I should watch?

The five to watch:

  • Bot detection

  • Tampering

  • VPN

  • Proxy

  • Country

example case: VPN + Country
You're a US business and your ICP is US based only - spam isolated to VPN-on bookings from a specific set of countries → they blocked VPN + those countries together.


Did this answer your question?