Device intelligence, in depth
Guides on fingerprinting, bot & AI-agent detection, account-takeover defense, and fraud prevention — from the team building open-source device intelligence.
Detecting Emulators and Cloned Apps
How emulator detection works on mobile: distinguishing emulators and cloned apps from real devices using hardware, runtime, and behavioral signals, plus attestation and integrity checks.
Read Privacy & complianceIs Device Fingerprinting Legal? GDPR and CCPA
Is device fingerprinting legal? A practical look at how GDPR, ePrivacy, and CCPA treat fingerprinting for fraud prevention, and how to deploy it compliantly.
Read FundamentalsWhat Is Device Fingerprinting? A 2026 Guide
A practical 2026 guide to device fingerprinting: how stable visitor IDs are built, what signals feed them, accuracy trade-offs, and where privacy law fits.
Read MobileDetecting Frida and Runtime Hooking
Frida detection for mobile apps: how runtime instrumentation and hooking work, the signals that expose Frida, Xposed, and gadget injection, and how to respond safely.
Read Privacy & complianceDevice Fingerprinting Under GDPR
How GDPR treats device fingerprinting: legal basis, consent versus legitimate interest, the ePrivacy storage rule, and how to build compliant fraud detection.
Read FundamentalsHow Canvas Fingerprinting Works, With Examples
A practical breakdown of canvas fingerprinting: how the HTML5 canvas leaks device entropy, why renders differ across machines, and how to use it responsibly.
Read FundamentalsBrowser Fingerprinting Entropy, Explained
Understand browser fingerprint entropy in bits, how to measure it, why some signals matter more than others, and how entropy shapes a stable visitor ID.
Read Privacy & complianceCCPA and Device Fingerprinting Compliance
How the CCPA and CPRA treat device fingerprinting, when a fingerprint is personal information, the security exemption, and a practical compliance checklist for fraud teams.
Read MobileStable Device IDs in React Native
How to build stable device IDs in React Native: why platform identifiers reset, combining signals across iOS and Android, and server-side verification for fraud.
Read MobileAdding Fraud Signals to a Flutter App
A practical guide to flutter fraud detection: collect device signals, verify server-side, detect emulators and tampering, and add attestation on iOS and Android.
Read Privacy & compliancePrivacy-Preserving Fraud Detection
Fraud detection and privacy are not opposites. Learn data-minimization patterns, on-device processing, and self-hosting that stop fraud without over-collecting.
Read FundamentalsWebGL Fingerprinting: What Your GPU Reveals
A technical guide to WebGL fingerprinting: how GPU rendering, shader precision, and driver strings expose device entropy, plus spoofing and detection trade-offs.
Read FundamentalsAudio Fingerprinting: How AudioContext Identifies Devices
How audio fingerprinting works: the AudioContext oscillator pipeline, why floating-point audio output varies by device, and how to use it as a stable signal.
Read Advanced signalsBehavioral Biometrics: Mouse and Keystroke Dynamics
How behavioral biometrics work: mouse movement and keystroke dynamics that separate humans from bots and flag account takeover, with privacy and accuracy trade-offs.
Read Privacy & complianceSelf-Hosting for Data Residency and Compliance
How self-hosting device intelligence solves data residency and compliance: keeping raw signals in-region, meeting GDPR and sector rules, and the architecture that keeps data under your control.
Read FundamentalsFont Fingerprinting: Detecting Installed Fonts
How font fingerprinting detects installed fonts through metric measurement, why the font list is high-entropy, and how to use it responsibly in device intelligence.
Read Privacy & complianceHonoring GPC and Do-Not-Track in Fingerprinting
Global Privacy Control and DNT explained for fingerprinting: what the signals legally mean, how they differ, and how to honor them while still preventing fraud.
Read Advanced signalsKeystroke Dynamics for Fraud Detection
How keystroke dynamics detect fraud: the timing features that identify humans and imposters, where the signal works, its limits, and how to use it privately.
Read Privacy & complianceData Minimization for Fraud Signals
How data minimization applies to fraud detection: collecting the least data that still stops fraud, using derived signals over raw PII, and self-hosting for control.
Read Advanced signalsMouse-Movement Analysis for Bot Detection
How mouse-movement analysis separates humans from bots using velocity, curvature, and timing, what it catches, its blind spots, and how to combine it with signals.
Read FundamentalsTLS Fingerprinting and JA4, Explained
How JA4 TLS fingerprinting works, what fields it hashes from the ClientHello, why it beats JA3, and how to use a ja4 fingerprint for server-side bot detection.
Read IntegrationAdd Device Fingerprinting to a React App
A hands-on guide to react device fingerprinting: install the SDK, get a stable visitor ID, verify server-side, and wire signals into login and checkout.
Read Advanced signalsHow to Detect Incognito and Private Browsing
How incognito and private browsing detection works across Chrome, Safari, and Firefox, why storage-quota tricks break, and how to use the signal responsibly.
Read FundamentalsWhat Is a Confidence Score in Device Identification?
A confidence score tells you how much to trust a visitor ID. Learn how device identification confidence is computed, what lowers it, and how to act on it.
Read FundamentalsCookieless Tracking: Alternatives After Third-Party Cookies
A practical guide to cookieless tracking after third-party cookies: device fingerprinting, first-party identifiers, and privacy-preserving fraud signals that survive deletion.
Read Advanced signalsDetecting Anti-Detect Browsers
Anti-detect browsers spoof fingerprints to run many fake identities. Learn how to detect them through signal inconsistency, entropy anomalies, and tampering checks.
Read IntegrationDevice Fingerprinting in Next.js
Integrate device fingerprinting in Next.js the right way: client collection, server-side verification in route handlers, App Router patterns, and edge middleware.
Read Advanced signalsDetecting Canvas and Fingerprint Spoofing
How to detect canvas spoofing and anti-detect browsers: spotting injected noise, impossible signal combinations, and cross-checking with server-side fingerprints.
Read FundamentalsDevice Fingerprinting vs Cookies: Key Differences
Fingerprinting vs cookies compared: how each identifies a device or browser, what breaks them, and when to combine both for durable, privacy-aware identity.
Read IntegrationServer-Side Verification With Node.js
How to verify device fingerprints server-side in Node.js: fetch the sealed result, validate it, and make risk decisions the client cannot forge, with working code.
Read Advanced signalsDetecting Device Farms and Fraud Rings
How to detect device farms and coordinated fraud rings using device fingerprinting, identity graphs, and shared-attribute clustering that expose scale a single session hides.
Read Bot detectionHow to Detect Headless Chrome in 2026
A practical guide to detect headless Chrome in 2026: the client and server signals that still work, why old tricks fail, and how to combine them without false positives.
Read IntegrationVerifying Fingerprints in Go
Server-side fingerprint verification in Go: validate sealed results, check freshness and integrity, avoid client-trust pitfalls, and wire it into your handlers.
Read Bot detectionDetecting Selenium, Puppeteer and Playwright
A practical guide to selenium detection and spotting Puppeteer and Playwright: CDP artifacts, driver leaks, timing signals, and durable server-side checks.
Read Advanced signalsIdentity Graphs for Fraud-Ring Detection
Fraud rings hide as unrelated accounts. Learn how identity graphs link accounts through shared devices and signals to expose coordinated fraud at scale.
Read IntegrationAdding Fraud Signals to a PHP App
A step-by-step guide to adding device intelligence and fraud signals to a PHP app: server-side verification, sealed results, and scoring login and checkout.
Read IntegrationDevice Intelligence in Python
Verify device fingerprints server-side in Python. A practical guide to validating visitor IDs, checking smart signals, and acting on suspect scores with FastAPI and Django.
Read Advanced signalsSealed Client Results: Why and How
What sealed results are and why they matter: encrypting and signing device-intelligence results on the client so your server can trust them without a round-trip, and how to verify them safely.
Read Bot detectionServer-Side vs Client-Side Bot Detection
Compare server-side and client-side bot detection: what each layer sees, how attackers evade them, and why the strongest defenses combine both with a shared score.
Read Bot detectionHow to Detect AI Agents Like ChatGPT Operator
A practical guide to detecting AI agents such as ChatGPT Operator: the signals that separate agentic browsers from humans and headless bots, plus how to respond.
Read IntegrationProtecting a Login Form With Device Signals
A practical guide to protecting a login form with device signals: risk-based auth, catching credential stuffing and ATO, and a step-by-step integration.
Read Advanced signalsHow a Fraud Reputation Network Works
Reputation network explained: how platforms share device risk signals privately to catch fraud earlier, the privacy design that makes it safe, and its real limits.
Read IntegrationStopping Signup Fraud at Registration
A practical guide to signup fraud prevention: the device and network signals that expose fake accounts at registration, how to score them, and where to add friction.
Read Bot detectionScraper Detection: A Practical Guide
A practical guide to scraper detection: the signals that separate scrapers from real users, why rate limits fail, and how to layer device intelligence and challenges.
Read Advanced signalsDesigning a Suspect Score for Risk Decisions
How to design a suspect score for risk decisions: weighting device and network signals, keeping it explainable with reason codes, and tuning thresholds against false positives.
Read Bot detectionDetecting Bots Behind Residential Proxies
Residential proxies hide bots behind real home IPs. Learn the device, timing, and network signals that expose automation even when the IP looks clean.
Read IntegrationRate Limiting by Device, Not IP
IP-based rate limits punish shared networks and miss rotating attackers. Learn how to rate limit by device fingerprint for fairer, more effective throttling.
Read Advanced signalsExplainable Fraud With Reason Codes
How explainable fraud reason codes turn opaque risk scores into auditable decisions analysts, users, and regulators can understand, dispute, and improve.
Read FundamentalsBot Detection Metrics That Matter
The bot detection metrics that actually matter: precision, recall, false-positive rate, catch rate, and time-to-detection, plus how to measure them honestly.
Read Bot detectionCAPTCHA Alternatives That Actually Work in 2026
CAPTCHAs frustrate humans and rarely stop modern bots. Here are the CAPTCHA alternatives that work in 2026: device intelligence, proof-of-work, and risk-based challenges.
Read IntegrationActing on Smart Signals via Webhooks
How to act on fraud webhooks in real time: subscribing to Smart Signals, verifying webhook payloads, designing idempotent handlers, and turning device events into automated decisions.
Read IntegrationEdge Bot Detection With a Cloudflare Worker
Cloudflare bot detection at the edge: run device and network checks in a Worker to block automation before it reaches your origin, with a self-hosted decision path.
Read Bot detectionProof-of-Work Challenges for Bot Mitigation
How proof-of-work bot challenges work, why they raise attacker cost without CAPTCHAs, tuning difficulty, and where they fit alongside device intelligence.
Read Fraud & ATOReducing False Positives in Fraud Detection
Practical methods to reduce false positives in fraud detection: confidence gating, graduated response, feedback loops, and reason codes that keep good users flowing.
Read Bot detectionSignals That Give Away Browser Automation
A field guide to browser automation detection: the navigator flags, timing tells, environment leaks, and network signals that expose Selenium, Puppeteer, and Playwright.
Read Fundamentals20 Device Intelligence Terms You Should Know
A concise glossary of 20 device intelligence terms, from visitor ID and confidence score to JA4, sealed results, and suspect score, explained for engineers.
Read IntegrationGating Traffic With nginx auth_request
How to build an nginx bot gate with auth_request: subrequest flow, forwarding device signals, caching decisions, and failing open so a detector outage never blocks users.
Read Bot detectionGood Bots vs Bad Bots: Classifying Traffic
Not all automated traffic is hostile. Learn to classify bot traffic into good, bad, and gray categories and route each with device intelligence signals.
Read ComparisonsThe Best FingerprintJS Alternatives in 2026
A clear-eyed look at the best fingerprintjs alternative options in 2026: self-hosted and SaaS, pricing, data residency, signal coverage, and migration.
Read ComparisonsMigrating From FingerprintJS, Step by Step
A practical migration guide from FingerprintJS Pro to a self-hosted stack: mapping visitor IDs, running in parallel, and cutting over without losing history.
Read Fraud & ATOAccount Takeover Prevention: A Complete Guide
A complete account takeover prevention guide: how ATO attacks work, the device and behavioral signals that catch them, and a layered defense you can ship without adding friction.
Read IntegrationServing a Fingerprinting Agent First-Party
Serving your fingerprinting agent first-party defeats ad blockers and shortens the request path. Learn the proxy patterns, trade-offs, and why self-hosting makes it simple.
Read ComparisonsOpen-Source Device Fingerprinting Options
A survey of open-source device fingerprinting options in 2026: what the libraries cover, where they stop, and what a full self-hosted platform adds.
Read Fraud & ATOHow to Detect Credential Stuffing Attacks
Credential stuffing detection explained: the signals that separate replayed stolen passwords from real logins, and how to score attempts without blocking real users.
Read ComparisonsSelf-Hosted vs SaaS Fraud Detection
A clear-eyed comparison of self-hosted vs SaaS fraud detection: data residency, cost curves, latency, control, and operational burden, with a decision framework.
Read ComparisonsWhy Self-Host Your Fraud Detection?
The case for self-hosting fraud detection: data residency, no per-call pricing, first-party agent serving, transparency, and the trade-offs to weigh honestly.
Read ComparisonsUnderstanding FingerprintJS Pricing
A clear breakdown of FingerprintJS Pro pricing: the per-API-call model, how costs scale with traffic, hidden line items, and how self-hosting changes the math.
Read Fraud & ATOImpossible Travel Detection, Explained
How impossible travel detection works: computing velocity between logins, why IP geolocation lies, and how device intelligence cuts the false positives that plague naive rules.
Read ComparisonsBuild vs Buy: Device Intelligence
A clear-eyed build vs buy analysis for device intelligence: what it really takes to build fingerprinting in-house, and when self-hosting an open stack wins.
Read Fraud & ATONew-Device Login Detection Without Friction
How new device login detection works without friction: stable device IDs, confidence scoring, and step-up logic that only challenges genuinely risky sessions.
Read Fraud & ATODetecting Multi-Accounting and Fake Accounts
How to detect multi-accounting and fake accounts using device intelligence, identity graphs, and behavioral links, without punishing legitimate shared devices.
Read ComparisonsCloudflare Turnstile vs Self-Hosted Proof-of-Work
Cloudflare Turnstile vs a self-hosted proof-of-work challenge: how each stops bots, where your data goes, and which fits a privacy-first, self-hosted stack in 2026.
Read IndustryDevice Intelligence for Fintech
How fintech fraud prevention uses device intelligence across onboarding, login, and payments to stop synthetic identities, ATO, and money-mule rings.
Read Fraud & ATODevice Signals That Catch Payment Fraud
The device and behavioral signals that catch payment fraud before authorization: velocity, device reuse, spoofing tells, and how to score them without adding friction.
Read IndustryEcommerce Fraud Prevention With Device Signals
How device intelligence reduces ecommerce fraud across checkout, chargebacks, promo abuse, and account takeover, with a signal-by-signal breakdown and integration pointers.
Read Fraud & ATOPreventing Promo and Referral Abuse
How promo and referral abuse works, why coupon rules never catch it, and how device intelligence links throwaway accounts behind one abuser to protect margins.
Read Fraud & ATOBonus Abuse in iGaming: A Detection Playbook
A practical playbook for detecting bonus abuse in iGaming: multi-accounting, device linking, and the signals that separate promo hunters from real players.
Read IndustryFraud Detection for iGaming
iGaming faces bonus abuse, multi-accounting, and collusion at scale. Learn the device intelligence signals that stop igaming fraud without adding user friction.
Read Fraud & ATOReducing Chargeback Fraud With Device Intelligence
Chargeback fraud drains revenue and inflates dispute ratios. Learn how device intelligence links orders to real devices, flags friendly fraud, and wins representments.
Read IndustryProtecting SaaS Accounts From Takeover
SaaS account security against takeover: the device and behavioral signals that catch stolen sessions, protecting admin and API access, and layering defenses without slowing down real users.
Read IndustryTrust and Safety for Marketplaces
Marketplace trust safety in depth: device intelligence against fake sellers, buyer fraud, collusion, and review abuse across a two-sided platform without adding user friction.
Read Fraud & ATOSynthetic Identity Fraud and Device Linking
How synthetic identity fraud works, why device linking exposes fabricated identities credit checks miss, and how identity graphs catch the rings behind them.
Read Fraud & ATODetecting Session Hijacking in Real Time
How session hijacking works, the device and network signals that expose a stolen cookie or token mid-session, and how to bind sessions to devices without breaking real users.
Read IndustryDetecting Account Sharing in Streaming
How account sharing detection works for streaming: device graphs, concurrent-stream signals, and household modeling that separates legitimate families from password sharing.
Read IndustryFraud Signals for Crypto Exchanges
The device and network signals that matter for crypto exchange fraud: account takeover, withdrawal risk, multi-accounting, bonus abuse, and bot-driven attacks.
Read Network & IPVPN Detection: How It Works and Its Limits
How VPN detection actually works, from datacenter IP ranges to latency analysis, plus the real limits and false positives you should design around.
Read Network & IPProxy Detection, Explained
How proxy detection works: the difference between datacenter, VPN, Tor, and residential proxies, the signals that expose each, and how to score proxy risk without blocking real users.
Read IndustryStopping Ticketing Bots and Scalpers
How to stop ticketing bots and scalpers: device intelligence, behavioral signals, and inventory-aware defenses that survive residential proxies and CAPTCHA farms.
Read IndustryDetecting Ad Fraud and Invalid Traffic
How to detect ad fraud and invalid traffic with device intelligence: click farms, bot impressions, attribution fraud, and the signals that expose fake engagement.
Read Network & IPDetecting Tor Exit Nodes
Tor detection done right: how to identify traffic from Tor exit nodes using the public consensus, fingerprint signals, and risk scoring without blocking legitimate users.
Read Network & IPDatacenter IP Detection With ASN Data
How datacenter IP detection works using ASN data: mapping addresses to hosting providers, why cloud egress signals fraud, and how to avoid blocking legitimate traffic.
Read IndustryFighting Fake Profiles on Dating Apps
How fake profiles, romance scammers, and bots infiltrate dating apps, why content moderation is too late, and how device intelligence stops them at signup.
Read MobileMobile Device Fingerprinting, Explained
How mobile device fingerprinting works on iOS and Android: the signals available in apps and mobile browsers, platform attestation, and detection trade-offs.
Read Network & IPResidential Proxy Detection: The Hard Problem
Why residential proxy detection is hard and what actually works: ASN and IP reputation, device consistency, behavioral signals, and layered scoring.
Read MobileDetecting Jailbroken iOS Devices
How to detect jailbroken iOS devices: filesystem and sandbox checks, App Attest, and why layered signals beat any single jailbreak test that Frida can hook away.
Read Network & IPIP Reputation: What It Is and How to Use It
What IP reputation means, how ASN, datacenter, and proxy signals build it, why it decays, and how to use it as a risk input without blocking real users.
Read Network & IPUsing ASN and Geolocation as Fraud Signals
How to turn ASN and IP geolocation into reliable fraud signals: what an ASN reveals, where geo databases fail, and how to combine both with device intelligence.
Read MobileDetecting Rooted Android Devices
How root detection works on Android, why simple checks fail against Magisk and hiding tools, and how to combine on-device and server-side signals reliably.
Read MobileApple App Attest, Explained
How Apple App Attest proves a request came from your genuine, unmodified iOS app on real hardware, the attestation and assertion flow, its limits, and where it fits fraud defense.
Read Network & IPDetecting IP Geolocation Spoofing
How geolocation spoofing works with VPNs, proxies, and residential exits, why IP location alone lies, and how to cross-check device signals to catch it.
Read Network & IPUsing MaxMind GeoLite2 for IP Intelligence
A practical guide to MaxMind GeoLite2 for IP geolocation and ASN lookups: accuracy limits, update cadence, and how to use it inside a fraud pipeline.
Read MobileGoogle Play Integrity for Fraud Prevention
Google Play Integrity attests app and device integrity on Android. Learn what its verdicts mean, how to verify them server-side, and their limits for fraud teams.
Read