// telltales/registry/registry.go
func NewDefaultRegistry() *Registry {
r := &Registry{} // 100+ detection rules
r.Register(TelltaleDefinition{
ID: "TT-071", Name: "property_descriptor_spoofed",
Category: Fingerprint, Weight: 0.85,
Evaluate: func(ctx *EvalContext) bool {
return ctx.PropertyDescriptorSpoofed
},
})
r.Register(TelltaleDefinition{
ID: "TT-076", Name: "canvas_noise_injected",
Category: Fingerprint, Weight: 0.85,
Evaluate: func(ctx *EvalContext) bool {
return ctx.CanvasNoiseInjected
},
})
r.Register(TelltaleDefinition{
ID: "TT-082", Name: "mouse_bezier_synthetic",
Category: Behavioral, Weight: 0.80,
Evaluate: func(ctx *EvalContext) bool {
return ctx.MouseBezierSynthetic
},
})
r.Register(TelltaleDefinition{
ID: "TT-089", Name: "stealth_plugin_partial_patch",
Category: Fingerprint, Weight: 0.85,
Evaluate: func(ctx *EvalContext) bool {
return ctx.StealthPluginPartialPatch
},
})
r.Register(TelltaleDefinition{
ID: "TT-063", Name: "client_hints_inconsistency",
Category: Network, Weight: 0.70,
Evaluate: func(ctx *EvalContext) bool {
return ctx.ClientHintsInconsistent
},
})
// ... 95+ more rules across 6 categories
// score = fired_weights / total_weights * 100
return r
}
100+ signals across behavioral analysis, device fingerprinting, environment probes, cryptographic chain verification, proof of work challenges, and conversational gatekeeper. Every decision traceable.
100+ telltale rules across 6 categories. Every decision traceable to exactly which signals fired and why.
Drop the SDK into any page. It collects 100+ signals across behavioral biometrics, environment probes (AudioContext, WebGL, canvas, fonts, emoji rendering, Web Workers), JS integrity checks (prototype tampering, property descriptors, stealth plugin detection), and cryptographic chain verification. Streams everything over WebSocket. No UI. No pop-ups. Users never know it's there.
When data-enforce="true", the SDK auto-injects a __zgate_token hidden field on form submit. Extract it server-side, call /v1/siteverify, and act on the verdict.
Z-Gate's edge middleware runs at the CDN layer — Vercel, Cloudflare, any edge runtime. Every request gets a pre-score before it ever touches your origin. Bots that don't even load JavaScript get caught here.
After a visitor passes behavioral analysis, the edge signs an HMAC cookie. Next request? Middleware reads the cookie, verifies the signature, lets them through. No SDK load. No WebSocket. No scoring. Verified humans get the fastest possible path.
python-requests/2.28 with no Accept-Language and no Sec-Fetch-Mode? That's a 75 before a single behavioral signal fires. Z-Gate runs 12 network-level checks — Client Hints consistency, Sec-Fetch validation, header order analysis, Accept patterns, Connection anomalies, stale UA detection — plus 22+ known bot signatures including Puppeteer, Playwright, and headless Chrome.
Datacenter CIDR? Tor exit node? Known bad actor? The edge caches IP reputation lists and checks every request in <1ms. No external API call. No latency penalty. Lists refresh every 5 minutes from your Z-Gate instance.
IP check + header heuristics run entirely at the edge. No round-trip to origin. Bots that don't even load JavaScript get caught here.
Verified visitors bypass all checks. Signed with SHA-256. Tamper-proof. 24h TTL. Returning humans get the fastest possible path.
Datacenter CIDRs, Tor exits, blocked ranges. In-memory. No external dependency. Lists refresh every 5 minutes from your instance.
npm i @zgate/next
Bots rotate fingerprints. Z-Gate correlates hardware signals across sessions to identify the physical device behind them — even when the browser fingerprint changes.
Renders audio through an OfflineAudioContext with oscillator + compressor and hashes the output. Real browsers produce unique waveforms from their audio stack. Headless browsers return silence — instant detection.
Executes a 128-iteration sin/cos fragment shader and measures GPU execution time across 5 runs. Real GPUs have scheduling jitter. Software renderers (SwiftShader) are impossibly fast with zero variance. Pixel output is hashed to detect known software renderer signatures.
Groups devices by physical hardware signals — GPU renderer, screen resolution, CPU cores, timezone, IP range. When a bot rotates browser fingerprints, Z-Gate sees the same physical device underneath. More than 3 identities from one device = flagged.
Every device gets a unique, persistent identity. The network graph reveals hidden connections — bot farms sharing IPs, fingerprint rotators on the same physical machine. Click any node to see every session, every IP, every identity change.
When behavioral analysis isn't enough and proof of work gets bypassed, Gatekeeper steps in. A friendly chat with quick questions and interactive micro-games — trivial for humans, impossible for scripts. No image grids. No frustration. Just a 30-second conversation.
Available on Pro & Enterprise plansAn ever-growing bank of challenges across multiple categories — speed tests, trick questions, opinion prompts, absurd scenarios. The mix changes every session. Every keystroke, pause, and correction is measured. LLMs can answer the questions, but they can't fake the typing.
Interactive challenges mixed into the conversation — catch a falling ball, rotate an arrow to a random target, long press, double tap. Each one samples mouse trajectories, measures precision timing, and captures behavioral signals that require a real browser with a real human behind it.
Every exchange is a data stream. Think time, typing cadence, keystroke variance, corrections, mouse trajectories, solve precision. All scored server-side in real time — the client sends raw behavioral data, the server computes the score. No client-side manipulation possible.
The gatekeeper doesn't use AI to judge responses. Questions come from a static bank with validators. Scoring is pure math — weighted behavioral signals with known thresholds. Every decision is traceable to exactly which signals fired and why.
Every request flows through the same pipeline. Edge pre-scoring catches the obvious. Behavioral analysis catches the sophisticated. PoW, tarpit, and the gatekeeper handle the gray zone. No image grids. No "select all traffic lights."
Traffic time-series. Historical analytics. Session replay with mouse trail playback. Click any session to drill down into every signal, or watch the bot move in real time. Mark false positives. Get webhook alerts on block spikes.
Get notified when your block rate spikes. Z-Gate monitors a 5-minute sliding window and fires a POST to your webhook URL when blocks exceed your threshold. Slack, PagerDuty, anything that accepts HTTP.
Mark any session as false positive or false negative directly from the dashboard. Track your detection accuracy over time and build confidence before switching from Monitor to Enforce mode.
Volume trends, score distributions, top telltales, and worst offender IPs — sliced by 24h, 7d, or 30d. Postgres-backed, not just in-memory. See patterns that real-time dashboards miss.
Every session gets a score. Every score triggers a response. Automatic escalation from allow to block — plus manual interventions when you need surgical control.
One click to permanently block any IP address. See every session from that address, unique fingerprints, block rate, and first/last seen. Unblock anytime from the dashboard.
Flag any device for a conversational challenge on their next visit. Useful when a session looks suspicious but the score is borderline. The device gets Gatekeeper regardless of score.
Mark any session as false positive, false negative, confirmed bot, or confirmed human. Add notes. Track feedback stats across your account. Every label improves your understanding.
Start free. Full protection included. Pay for deeper visibility.