01
Challenge
The loader pulls a nonce, a proof-of-work target and a per-session VM — wrapped in an opaque binary envelope.
Anti-bot perimeter
Bots get a
Bots get a
silent no.
A WebAssembly verifier scores every session in under 200ms. Humans pass with no captcha. Bots get a poisoned token your backend quietly rejects.
No SDK lock-in · verify offline with your secret
Bots refused
167
Requests screened
1,662
Median verdict
180ms
Pipeline
Challenge. Verify. Verdict.
Three stages on every protected request — end to end in under 200ms.
02
Verify
A Rust→WASM core fingerprints 190+ signals, runs the VM, solves the PoW and collects automation + behaviour probes.
03
Verdict
The engine scores seven dimensions into one number. Humans get a signed token; bots get a poisoned reject.
Detection
No single signal decides.
Seven dimensions, scored independently. Any one critical tell ends it.
Fingerprint
190+ signals — canvas, WebGL, audio, fonts — cross-checked for the impossible.
Environment
webdriver flags, headless markers, prototype tampering and eval hooks.
TLS & HTTP
curl, Python and Go give themselves away in the handshake.
Automation
CDP runtime, Puppeteer / Playwright, worker-heartbeat debugger.
Behaviour
Pointer entropy and keystroke cadence — humans jitter, scripts don't.
Proof-of-work
Hashcash gate plus a per-session VM that rotates every challenge.
Device history
Returning devices build trust; fingerprint reuse across IPs flags farms.
Honeypots. Outside the weighted score, because a single hit ends the session
on its own: decoy routes, datacenter ranges and velocity — instant flags.
Verdict
Two outcomes. One is silent.
ALLOW
Humans pass untouched
No captcha, no friction — a signed token you trust offline. They never know a perimeter exists.
BLOCK
Bots get a poisoned token
A 200 OK indistinguishable from success. Your backend reads the reject; the bot thinks it won.
Integration
One script.
One script.
One offline check.
Drop the loader on your page; verify the token in your backend with your site secret. No callback to us on the happy path.
// frontend import { runChallenge } from '@instantblock/loader'; const { token } = await runChallenge({ sitekey }); // backend — offline, with your secret const claims = verifyToken(token, SECRET); if (claims.decision !== 'accept') block();
Self-analyze
Catch yourself in real time.
Run the actual engine against this browser. Live client signals, a real proof-of-work, and the same seven-dimension verdict our customers get — nothing simulated.