4 ms·

While that might be true, this feels like it would be a long way off. The prefixes could potentially match millions of sites and the results are only then match

While that might be true, this feels like it would be a long way off. The prefixes could potentially match millions of sites and the results are only then matched on the client side. The server would never know which prefixes are the “actual” hit and which are obfuscated prefixes for completely different domains.

lallysingh 7y ago
Simple: the service provider visits these sites itself, gets hashes of all the resources for the homepage and relevant links (or just spiders them). With the set of hashes, look at prefixes. Users who request one prefix in that set aren't suspicious. Users with many prefixes in that set are.