FAKE ACCOUNTS AND MULTI-ACCOUNTING
Stop one person from opening ten accounts. Without stopping the real customers who share an office Wi-Fi.
LR Defender recognizes the device behind each sign-up, even after a cookie wipe, a private window or a new VPN exit, and checks it for automation and risky networks. Your sign-up handler gets allow, challenge or block with the reasons.
- 01Sign-upChecked here
- 02Login
- 03Promotions
What runs there
- Device ID
- Automation
- Network
Your sign-up handler gets
The playbook
How the abuse works.
New email.
A fresh address from a free provider or a catch-all domain.Clean slate.
Cookies cleared, a private window, sometimes a new browser profile.New exit.
A different VPN server or residential proxy for each sign-up.
Each step defeats a check that relies on stored identifiers or IP addresses.
What we check
What LR Defender checks at each step.
New email
What we check
The device behind the address: seen before, how often, first seen when.
What you get back
The device ID, how many times it has visited, and when it was first seen.
Clean slate
What we check
The device is recognized from signals, not storage.
What you get back
The same device ID, how the visit was matched, and how closely.
New exit
What we check
VPN, public proxy, datacenter and Tor. In the browser, the timing or WebRTC check can also name a residential proxy no list covers. When nothing names one, it is reported as unknown.
What you get back
Whether the address is a Tor exit, a VPN or in a datacenter, and the recommended action.
Every step
What we check
Automation on the sign-up itself.
What you get back
Whether the checks found a bot, whether a hard automation signal fired, and the recommended action.
Try it
Try the clean-slate step on yourself.
Step 1: Scan
Collect signals in this browser and derive a device ID from them.
Wiping really clears local storage for this site in your browser, so sign-in state on this site may be affected. Cookies are not touched.
Step 2: Wipe
Clear this site's local and session storage, for real.
Step 3: Re-scan
Derive the ID again, from signals alone, with storage empty.
Run the scan to list the real keys stored here.
This demo derives the ID from measured signals in your browser, so you can watch it happen. Production matching runs on our servers, with fuzzy matching over the collected signals rather than a single exact hash.
Where to call it
Call it in your sign-up handler.
- 01
Your server
Mint a session token when you render the sign-up page.
- 02
The browser
Call identify() when the form is submitted and send requestId with the form.
- 03
Your server
In your handler, fetch the verdict and decide before you create the account.
One script tag and two calls from your server.
Policy starting point
A starting point. Tune it on your own traffic.
| Situation | Suggested action |
|---|---|
| A hard automation signal | Block |
| The device already opened an account this week | Review, or challenge with email verification |
| Datacenter address or Tor at sign-up | Challenge |
| VPN only, new device | Allow, and watch the next login |
| Residential proxy unknown | Treat as unknown, not clean. Decide on the other evidence. |
Measure it on your own sign-ups.
After a demo call, we set up your account and email you a link to set your password. It starts with a 90-day free trial on the Pro plan's limits, with no card.