If you control the domain you're fingerprinting clients on, you can decrypt the inner ClientHello and fingerprint on that. If you're not in control of the doma

If you control the domain you're fingerprinting clients on, you can decrypt the inner ClientHello and fingerprint on that. If you're not in control of the domain you're fingerprinting, then ECH is working as intended. I don't expect naive bots to implement ECH any time soon, though. If a bot can't be bothered to download curl-impersonate, they won't pass any ECH flags either.