Check the session
behind the action.
Use browser and connection findings to check registrations, compare account attempts, and apply your scraping policy.
Check before creating the account.
A verified email or phone number does not establish a new customer. Browser profiles and proxy connections can also change between account attempts.
Heretic checks browser claims against API behavior and the observed connection. Your backend can reject a signup, compare its identifiers with existing accounts, or request a phone challenge. Our own registration uses the same APIs.
Read the fake accounts pageCompare registrations with existing accounts.
Trial abuse and referral farming depend on repeated account creation. Compare the browser and connection behind each attempt, while accounting for shared devices and addresses in your own policy.
Heretic returns instance, machine, and rendering identifiers when their inputs are available. Store them with each account, including scope and version. A match establishes matching inputs, not a unique device or person.
Read the multi-accounting pageInspect browser automation.
An HTTP client can claim Chrome, and a driven browser can hide its automation markers. Heretic checks for declared automation, replaced APIs, inconsistent browser properties, and conflicting connection behavior.
An opened session with missing required measurements returns refused. If no session opens, no assessment exists. Require a completed check on your backend before accepting a protected action.
Findings for each use case
Try a browser check.
Open the live demo to inspect a verdict and its findings.