Fake account and signup fraud detection

What the form currently checks

Email. Disposable address services are free. Gmail dot and plus addressing turns one mailbox into unlimited valid addresses. A catch-all domain costs a few dollars a year and produces infinite addresses on a domain no blocklist has heard of.

Phone. Virtual number services sell SMS-receiving numbers per verification, often for cents. Phone verification raised the price of an account from nothing to roughly a coffee per hundred, which mattered in 2014.

IP address. Residential proxy networks resell the connections of real household subscribers. The exit address is a genuine ISP line with no history and nothing to block. Mobile proxies put thousands of legitimate subscribers behind one carrier-grade NAT address, so blocking it is not an option.

Browser fingerprint. Every value in one is a JavaScript property, and an anti-detect browser is a control panel for setting them. Forty profiles, forty hashes.

What Heretic measures instead

The registration page loads one script. From inside the browser it opens a session to our bare-metal sensor, which reads the parts of the connection the page cannot write.

• The TCP SYN options the kernel set. Initial TTL, maximum segment size, window scale and option order identify Linux, Windows or Darwin. A user agent claiming macOS over a Linux SYN is stack.os-contradiction.
• The TLS ClientHello the client library built. Chromium sends GREASE values in several places; a client claiming Chromium that sends none did not come from Chromium.
• The HTTP/2 preface, settings and pseudo-header order, which identify the HTTP stack. A Chromium user agent over Go's net/http2 is http.h2-stack-contradicts-tls.
• Whether a browser advertising HTTP/3 ever sends a QUIC Initial. Many automation stacks and proxy chains cannot, and never try.
• The handshake round trip against the nearest point of the timezone the browser claims. A round trip faster than light could cross that distance is geo.rtt-below-vacuum.
• The JavaScript object graph. Shadowed navigator getters, rebound WebGL methods, plugin collections that contradict their own lookup methods, and realms that disagree with each other about the timezone.

What comes back

One verdict, contradicted, refused or uncontradicted, and every finding under a stable ID with its tier. Alongside it, the address the connection arrived from, the transport snapshots, what the browser claimed, the network and concealment fields, and two device identifiers scoped to your site key.

A client that blocks the script, strips headers or never finishes the measurement returns refused. It does not get the benefit of the doubt, because otherwise the cheapest way past your signup form is to stop answering.

Escalating without a CAPTCHA

A verdict tells you something is wrong. It does not tell you what to do, and blocking on it alone turns away the occasional privacy tool along with the farm. So the second move is a device ceremony rather than a puzzle.

Hold a phone level, so the accelerometer reads a flat still device. Hold it steady while the processor and thermals are measured under load. Turn it sideways, so the gyroscope confirms a real rotation. Confirm with a passkey that signs the readings. It ends passed, contradicted or not_completed, with the step named, and there is no SMS code offered as a way around it.

The outcome names the device it ruled on, so a cleared registration is something you can write to your own ledger.

We run it on our own signup

Heretic's registration page is a Heretic customer. It loads the collector under our first-party site key, and the gate calls the public API with a tenant secret exactly the way your backend would. A probe whose identity matches an existing account is refused before a ceremony is offered. Repeat, contradicted, refused or concealed sessions are stepped up. Only a fresh probe passes straight through.

Same API, same keys, same failure modes you would get.

What it does not do

It does not tell you a visitor is a person, and uncontradicted is not a claim that they are. It is a statement about our measurements and it is bounded by them. A real Chrome on a real Windows machine behind a residential proxy produces an honest transport stack, because it is one. What the measurement does is make that the cheapest remaining attack, and that costs a device.