Bot Defense & Sybil Resistance Cheat Sheet
Master quick-reference guide for system architects defending distributed platforms against automated account creation, credential stuffing, scrapers, and reward farming.
Master quick-reference guide for system architects defending distributed platforms against automated account creation, credential stuffing, scrapers, and reward farming.
1. The Sybil Defense Equation
An attack stops being viable when the cost to execute exceeds the expected liquid return:
- Defense Invariant: Ensure by eliminating instant liquid reward payouts on unverified registrations.
2. 4-Layer Defense-in-Depth Pipeline
Synthesizing vector architecture diagram...
Follow a sign-up from left to right through four checks, ordered from cheapest to most involved. A hidden honeypot field, which humans never see, catches most naive bots at no cost to real users. An in-memory disposable-email lookup rejects throwaway inboxes. Cloudflare Turnstile runs an invisible challenge that headless browsers struggle to pass. Finally, rewards are held in escrow (5 coins at once, 35 after a real milestone), so even accounts that get through earn nothing quickly. The first three layers make fake accounts harder to create; the last one makes them worthless, which is what really stops a determined attacker.
3. Human Verification Tech Comparison
| Metric | Honeypot Field | Disposable Blocklist | Cloudflare Turnstile | Google reCAPTCHA v2 | Hashcash Proof of Work |
|---|---|---|---|---|---|
| Latency Overhead | |||||
| User Interaction | None | None | None | Image Grid Puzzles | CPU crunch (battery drain) |
| Accessibility (WCAG 2.2) | Fully Compliant | Fully Compliant | Fully Compliant | Fails 3.3.8 | Fully Compliant |
| Bypass Cost for Bot | Negligible | Low (buys domains) | High (requires real browser) | Cheap (/solve) | High (scales with difficulty) |
| Privacy / Tracking | Zero tracking | Zero tracking | No ad cookies | Cross-site Google cookie | Zero tracking |
4. Key HTTP Status Codes & Ingress Headers
| Code / Header | Purpose | Example |
|---|---|---|
HTTP 200 Mock OK | Silent Honeytrap: Fake success response for honeypot traps without writing to database. | Prevents bot from learning which field was trapped. |
HTTP 422 Unprocessable | Domain validation error for disposable email addresses. | {"error": "Please use a standard email provider"} |
HTTP 429 Too Many Requests | Rate limit breached on IP or /24 subnet. | Include Retry-After: 60 header. |
CF-Connecting-IP / X-Real-IP | True client origin IP behind CDN reverse proxies. | Use for subnet rate-limiting (/24 CIDR). |
Sec-CH-UA | Modern Client Hints identifying real Chromium / WebKit engines. | Absent in simple curl / urllib scrapers. |
JA4 Fingerprint | Cryptographic hash of client TLS ClientHello parameters. | Identifies python-requests, Go-http, or Playwright. |
5. AWS Production Architecture Toolkit
- AWS WAF:
AWSManagedRulesBotControlRuleSet+ Rate-based rule (e.g. 50 requests / 5 minutes / IP). - Amazon CloudFront + Lambda@Edge: Sub-millisecond pre-flight disposable domain blocklist lookup.
- Amazon ElastiCache Redis: Sliding window counter tracking registration velocity by IP and email prefix.
- Amazon DynamoDB: Conditional
attribute_not_exists(email)for atomic single-registration invariant. - Amazon SES: Bounce & complaint rate dashboard monitor (keep bounce rate to protect sender reputation).