Online communities & UGC
Spam rings, sockpuppets and ban evasion, without demanding a phone number from every new member.
What the problem actually is
Community platforms are attacked by volume: spam accounts posting links, coordinated sockpuppets manufacturing consensus, and banned users returning immediately. The usual defence — mandatory phone verification — works, and also drives away a large share of the genuine members you wanted, particularly the privacy-conscious ones who are often your best contributors.
Signals that carry the weight here
Sockpuppetry and ban evasion are one person wearing many names. The device is the shared thread.
Throwaway addresses correlate strongly with accounts created to post once and be abandoned.
Headless browsers and automation frameworks are what mass registration actually runs on, and they are detectable without challenging a human.
Where to start
strictness=1 (balanced) — Balanced, and prefer rate-limiting or a review queue over hard blocks. Communities are damaged more by wrongly excluding a real member than by one spam post that gets removed.
A defensible starting point, not a guarantee. Strictness moves the verdict thresholds only; the risk score itself never changes, so you can re-tune without re-scoring anything.
The call
curl -X POST "https://www.layercall.com/v1/score/user" \
-H "X-Api-Key: YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"ip":"$IP","email":"$EMAIL","device_id":"$DEVICE_ID"}'1,000 lookups a month free, no card. Get an API key.
Questions
Is this a replacement for CAPTCHA?
It is a complement, and a quieter one. Bot detection here is passive — it reads what the browser already exposes, so genuine members are never asked to identify traffic lights. It will not stop a determined human running a real browser, which is what a CAPTCHA also fails to stop.