Live: Tor + abuse feeds refreshed every 6 hours

LayerCall

Device Intelligence

Recognise the machine, not the address it hides behind.

POST/v1/score/device

Drop one script tag on your signup page to get a stable device id that survives incognito and cleared storage, because it uses no cookie and writes nothing to the device.

What it detects

  • Repeat devices across accounts
  • Headless browsers and automation frameworks
  • Bot probability, scored separately from risk
  • Timezone that disagrees with the IP's country
  • Device abuse history across the network
  • Selenium, Puppeteer and Playwright markers

When to use it

The signal that catches the same person on their fortieth fake account.

Questions

Does fingerprinting need a cookie or user consent banner?

No cookie is set and nothing is written to the device — that is why the id survives incognito and cleared storage. It is still a form of identification, so document it in your privacy policy and rely on a legitimate-interest basis for fraud prevention, as you would for any anti-abuse measure.

What stops a bot from simply faking the signals?

Automation markers are collected but deliberately not hashed into the device id. So a bot that patches navigator.webdriver hides that one flag — and keeps the same identity, along with all the abuse reputation attached to it. Server-side User-Agent analysis runs independently of anything the client claims.

Why is bot probability separate from the risk score?

Because “this is a script” and “this is dangerous” are different questions. Plenty of automated traffic is legitimate — monitoring, integrations, accessibility tooling. Collapsing them into one number would force you to choose between blocking honest automation and ignoring real bots.

How to do this

Step-by-step, with the trade-offs named.

Other products