Hydra: The Beast That Multiplies
Multi-accounting spreads the way the Hydra grows: block one fake account and two more take its place, each farming trials, referrals, and sign-up bonuses.
You've captured the Hydra. Your next trail clue is unlocked at the bottom of this page.
The Hydra sprouts two new heads for every one you sever. Multi-accounters work the same way: cut off a fake account and two more spin up, farming free trials, referral credits, and sign-up bonuses faster than you can ban them.
How to prevent the Hydra's attack
Multi-accounting is when one person, or one automated script, creates many accounts to claim rewards meant for new users: free trials, referral credits, welcome bonuses, promotional pricing. Because each account looks legitimate on its own, the abuse goes unnoticed until the cost of all those 'first-time' incentives adds up.
Banning accounts one by one is a losing game: attackers rotate emails, IPs, and proxies to spawn replacements instantly. Effective prevention links accounts back to the shared device and browser behind them, so you can see the whole cluster instead of chasing individual heads.
Prevention checklist
- Link accounts to the device and browser behind them, not just the email or IP, which rotate freely and cheaply.
- Fingerprint sessions at signup so a returning device is recognized even through a fresh email and a new proxy.
- Watch for clusters of accounts sharing hardware, timing, or behavioral patterns and all claim the same incentive.
- Rate-limit and challenge new signups by device reputation instead of adding friction for every genuine customer.
- Detect headless browsers and automation frameworks farming trials before the bonus is ever granted.
Risk signals and how to respond
Many accounts from one device
Rapid signups after each ban
Rotating emails and proxies, same fingerprint
Bonuses claimed, then accounts go dormant
| Risk signal | What it may indicate | Response |
|---|---|---|
| Many accounts from one device | Multi-accounting or trial farming | Link accounts by device and block the cluster |
| Rapid signups after each ban | Automated replacement accounts | Challenge new devices, not just new emails |
| Rotating emails and proxies, same fingerprint | Evasion of email- and IP-based limits | Match on device and behavioral signals |
| Bonuses claimed, then accounts go dormant | Referral and promo abuse | Flag incentive-only accounts for review |
What it looks like in cside
Concurrent session and device signals
cside links accounts back to shared devices and enforces graduated responses as risk rises.
Suspicious session signals
Session-level signals surface the automated traffic spinning up fake accounts to farm bonuses.
Next Trail Clue
The next creature is still hidden. This clue will point players toward the next cache once the final location is confirmed.
CLUE PLACEHOLDER: [Insert next location riddle here]
Keep this page bookmarked. The riddle appears here when the trail opens.