3 ms·
Setup Cloudflare on the domain and turn on “bot fight mode”. If the TLS ciphers the client proposes for negotiation doesn’t align with the client’s User-Agent
by halifaxbeard 4y ago
Setup Cloudflare on the domain and turn on “bot fight mode”.
If the TLS ciphers the client proposes for negotiation doesn’t align with the client’s User-Agent they get a CAPTCHA.
I would suspect that whoever is doing this proxy-mirroring isn’t smart enough to ensure the TLS ciphers align with the User-Agent they’re passing through.
- nezirus 4y agoI would agree with the above, as an easier version of TLS fingerprinting. One could also ise nginx/haproxy to extract enough TLS info, and detect requests xoming through proxy Magic string: JA3 fingerprint
- supriyo-biswas 4y agoOn the free tier, does bot fight mode do anything other than simply detect bots based on JavaScript detections?
- strictnein 4y agoThis is the correct first step.
- deleted 4y ago[deleted]