Abuse detection for AI startups.
Some users sign up again and again. Attacal spots them before they drain your free tier.
Free tiers have a long tail.A few accounts burn most of it.
Sort your free usage by account. A handful of accounts use most of it. Often they are one person, one shared key, or one script.
Accounts6 of 100
Free tier spend68%
Free tiers attract more than users.What Attacal catches.
Fake accounts
Throwaway emails and made-up signups that will never pay.
24 signups3 throwaway emails
Resold API keys
One paid key, shared or sold to hundreds of people.
12 countries1 plan, 214 people
Free tier abuse
One person farms the free credits on account after account.
Each one hits the cap12 accounts, 1 card
Bots and agents
Scripts that drain your product around the clock.
01:00 to 06:003 accounts, 1 script
Three steps, one API.How it works.
- 01
Send what you know.
Signups, logins and usage, with everything you know: IP, device, email, card, API key.
track("signup")
- user_idu_1046
- emailjokr.91@proton.me
- ip185.220.101.4
- devicedv_8f2c41
- cardfp_Tq81xK
- api_keykey_live_3a
- usage2,210 tokens
- 02
Attacal links the accounts.
Attacal matches the signals and groups the accounts that belong to one person.
Matched signals
- Same device
- Same card fingerprint
- Same IP range
- Emails follow one pattern
3 accounts, 1 person
- 03
You decide what happens.
You see who it is and what it cost. Slow them down, ask for a card, or ban.
Webhook
3 accounts belong to one person. They used $412 of free usage.
Slow downAsk for a cardBan
An API built for developers.
Three parts. Send events, get a webhook, read the evidence.
Send events
From your server. No browser script.
POST /v1/events
await attacal.track("signup", { userId: user.id, email: user.email, ip: req.ip, device: req.headers["x-device"], card: card.fingerprint, });Get a webhook
Sent when Attacal finds a group.
POST your-app.com/webhooks
{ "event": "abuse.detected", "type": "free_tier_abuse", "accounts": 3, "people": 1, "cost_usd": 412 }Read the evidence
Every group comes with its reasons.
GET /v1/groups/grp_81
3 accounts, 1 person, $412
- Same device on all 3
- Same card fingerprint
- Signed up within 2 minutes
- Emails jo.k+1, jo.k+2, jokr.91
Radar stops at the door.
Stripe Radar guards payments. WorkOS Radar guards sign-ins. Attacal watches what accounts do once they are in.
Attacal
- Looks at
- Signups and usage
- Links accounts to one person
- Across signup and usage
- Sees API usage and shared keys
- Yes
- Catches bots
- On API usage
- Works with
- Any auth, any billing
Stripe Radar
- Looks at
- Payments and signups
- Links accounts to one person
- At signup, on Radar Pro
- Sees API usage and shared keys
- No
- Catches bots
- On payments
- Works with
- Stripe customers
WorkOS Radar
- Looks at
- Sign-ups and sign-ins
- Links accounts to one person
- Repeat sign-ups by email
- Sees API usage and shared keys
- No
- Catches bots
- On sign-in
- Works with
- WorkOS auth
Before you ask
Do I need a browser script or fingerprinting?
No. Your server sends the events, so API, CLI, MCP and mobile traffic all count.
What data do you need?
A user ID per event. IP, card, API key and token counts make the matches stronger. Hash anything you'd rather not send.
Will it block real users?
Attacal doesn't block anyone. It tells you who it found and why, and you decide what to do.
How long does it take to integrate?
An afternoon: two calls and a webhook handler. During early access I help you set it up.
What does it cost?
Nothing during early access. After that it's usage based, and you hear the price before anything changes.
15 minutes, with the founder
See who's burning your free tier.
Show me where abuse costs you money. I'll show you what Attacal would catch in your data.
- Quiet accounts
- Active users
- 4 accounts, 1 person