LayerSift
Log inStart free
Network, device and behavior in one API call

Every request, sifted layer by layer.

LayerSift reads every visitor at three layers: the network it arrives on, the device it runs, the way it behaves. Each browser keeps its visitor ID through cleared cookies and incognito windows, and bots, VPNs, virtual machines and tampered browsers stop at the layer that gives them away.

Start free trialTry the live demo
const agent = await Antibot.load({ apiKey: "pk_live_…" })
const { visitorId, confidence, products } = await agent.get({
  extendedResult: true,
})

if (products.bot.result === "bad") return block()
if (confidence.score > 0.95) return trust(visitorId)

See what we read from your browser, in one click:

Your visitor ID
—

Nothing is read from this browser until you press Identify. Then our agent reads it as it would on a customer's page, and the result is kept in our demonstration organization for a week.

Match confidence

—

Waiting for identification

Suspect score

—

Bot

Clear

…

Incognito

Clear

…

VPN

Clear

…

Proxy

Clear

…

Tampering

Clear

…

Virtual machine

Clear

…

DevTools

Clear

…

Remote control

Clear

…

Privacy mode

Clear

…

Request context
Browser—
Operating system—
IP addresslocal
LocationPrivate network

Accuracy improves with production traffic volume — this demo organization has a small identity graph.

$10M+

ARR recovered

by stopping password sharing across a streaming subscriber base.

$80K

Monthly fraud prevented

at a marketplace that blocked repeat offenders at signup.

90%

Fewer chargebacks

for a payments team after adding device history to their rules.

Three layers. A bot has to fool all of them.

A bot can fake one thing at a time: a user agent, a screen, a mouse path. LayerSift reads each layer on its own and checks it against the others, so a lie told at one layer shows at the next.

  1. Layer 1
    Network
    The TLS handshake (JA4, JA3) and the HTTP/2 settings, read where TLS ends, and the address: VPNs, proxies, Tor exits, hosting ranges and its history.

    Stops here

    HTTP libraries posing as ChromeReplayed cookiesProxy and hosting farms
  2. Layer 2
    Device
    A visitor ID that survives cleared cookies and incognito, and a browser cross-checked against the engine that made it: automation globals, driver artefacts, patched functions, virtual machines.

    Stops here

    Headless ChromePuppeteer, Playwright, SeleniumAnti-detect browsersVirtual machines
  3. Layer 3
    Behavior
    How the page is driven (pointer, keyboard and timing) and how fast one device moves across addresses, countries and accounts.

    Stops here

    Scripted clicksCredential stuffingSign-up bursts

One identifier, six fraud problems

Every one of these reduces to the same question: have we seen this device before, and should we trust it? LayerSift answers it in the request.

Payment fraud

Recognise the device behind a card before it clears, even when the billing details are brand new.

New account fraud

Catch the twentieth account from a device that already burned nineteen.

Account takeover

Step up authentication only when the device does not match the account's history.

Account sharing

Count real devices per subscription instead of guessing from IP addresses.

Coupon & promo abuse

One signup bonus per device, not per throwaway inbox.

Credential stuffing

Spot automation frameworks and headless browsers before the first password is tried.

FintechE-commerceBuy now pay lateriGamingMarketplacesStreaming

Smart Signals, with the evidence attached

Every signal ships with the reasons that produced it, so you can tune thresholds against your own traffic instead of trusting a black box.

Visitor ID
A stable identifier that survives cookie clearing, incognito windows and browser updates — matched by weighted component similarity, not a single hash.
Bot detection
Separates search crawlers from Selenium, Playwright, Puppeteer and headless Chrome using automation globals, driver artefacts and behavioural timing.
Tamper detection
Flags patched native functions, spoofed user agents and anti-detect browsers by cross-checking every identity claim against the engine that made it.
VPN & proxy
Timezone mismatch, public VPN ranges, residential proxy networks and relay egress, each with its own confidence and ML score.
Incognito detection
Private browsing across Chromium, WebKit and Gecko — quota heuristics, storage probes and service-worker availability per engine.
Virtual machines
Software renderers, hypervisor framebuffers and default VM resolutions, so farm traffic does not pass as retail.
IP intelligence
Geolocation, ASN, hosting provider, Tor exit relays and impossible-travel detection against the device's previous sighting.
Velocity & rarity
Distinct IPs, countries and linked IDs per device across 5-minute, 1-hour and 24-hour windows, plus rare-device and high-activity flags.
Suspect score
Every signal folded into one 0–100 number you can threshold, with the contributing evidence attached to each event.

Built to be verified, not just believed

The browser result is a convenience. The authoritative answer lives behind your secret key, so a tampered client cannot talk its way into a trusted decision.

  • Server-side verification. Re-read any event by ID with a secret key.
  • Signed webhooks. HMAC-SHA256 with replay protection on every delivery.
  • Velocity built in. Distinct IPs, countries and accounts per device, pre-computed.
  • Full data control. Delete an event or an entire visitor with one call.
Read the API docsInspect a live payload

“We cut false positives by 6% in the first month. The difference was being able to see why a device was flagged instead of arguing with a score.”

FH

Risk Engineering Lead

Online travel marketplace

Live in an afternoon

No SDK sprawl, no tag manager archaeology. Three steps.

  1. 1
    Create an organization
    14-day trial, no card. Public and secret API keys are issued instantly.
  2. 2
    Drop in the agent
    One script tag, 28 kB. It collects device entropy and returns a visitor ID in milliseconds.
  3. 3
    Decide on your server
    Re-read the event with your secret key and act on the visitor ID, confidence and signals.

Stop guessing who is on the other end.

Start identifying visitors in the next ten minutes. Free for 14 days, then priced on identifications, not seats.

Start free trialOpen playground