Anti.Bot

Standard Protocols

WebRTC

SCAN

QUIC

Latency Evaluation

CHECK

OS Fingerprint

Detected OS:

—

Mismatch:

—

Detected DNS Servers

IP Address	Country	Provider	VPN Score	Proxy Score	Threat Score	Trust Score	Fraud
Testing DNS servers...

Testing DNS servers...

Detected EDNS Client Subnets

Client Subnet	Prefix Length	Resolver IP	Flag	Country
Testing EDNS...

Testing EDNS...

Full IP Information

Type	Family	IP Address	Flag	Country	City	ZIP	Time Zone	ISP / ASN	VPN	Proxy	Tor	Hosting	Fraud Score
Gathering information...

Gathering information...

Stage 4 · Verdict History · Analytics

Score History

Idle

Total—

Unique IPs—

Avg score—

With active—

Window—

Stage 5 · Mitigation offline allow

Last score—

Effectiveallow

Trust tokennone

Difficulty—

idle

clean0

susp0

likely0

bot0

unkn0

Stage 7 · Dual-Stack · IPv4 ↔ IPv6 · DPI · TURN · QUIC collecting

IPv4

IP—

Country / ASN—

ISP—

Flags—

DPI · JA4 · QUIC · H2—

Channels—

IPv6

IP—

Country / ASN—

ISP—

Flags—

DPI · JA4 · QUIC · H2—

Channels—

Mismatch: 0 allow

Stage 10 · Channel Asymmetry · RTT · H2 / QUIC FP collecting —

TCP RTT—

WebRTC RTT—

WebSocket RTT—

QUIC/WT RTT—

WebRTC − TCP delta—

QUIC − TCP delta—

HTTP/2 ALPN seen—

QUIC version / SNI—

Reasons—

Recent verdicts (0)

—

Stage 1 + 2 · Suricata · Score Engine · Dual-Stack

Deep Packet Inspection

Initializing…

IPv4 — —

—

Awaiting fingerprints… conf —

No data yet — generate TLS traffic to populate signals.

Signal breakdown (0)

Events captured—

TLS version—

QUIC seen—

HTTP/2 seen—

ALPN—

SNI—

JA3—

JA4—

JA3S / JA4S—

Anomalies—

Microsoft Smart DPI no data —

Process—

Category—

OS guess—

Residential proxy—

OpenVPN/TCP—

WireGuard—

Microsoft TLS FP—

Microsoft Guard reasons—

ntop nDPI no data —

Flows seen—

Confidence—

Detected protocols—

Categories—

VPN / anonymizer—

SNI—

JA3 / JA4—

nDPI risks—

Reasons—

ML PCAP no data —

Flows seen—

Chosen label—

Source—

Heuristic—

Model—

Top classes—

Top apps—

Top categories—

Reasons—

DNS Analytics passive sniffer · per-test awaiting —

⚡

Waiting for DNS leak-test traffic…

The collector indexes lookups of <testId>.dns4.anti.bot via your current resolver. If nothing appears, your VPN may use sealed DoH or your browser cached previous prefetches.

Queries seen—

Unique domains—

NXDOMAIN ratio—

Public resolver %—

DoT/DoH hits—

Burst (qps peak)—

Mean qname len—

Mean entropy—

Resolvers—

Top qtypes—

Recent qnames—

Tunneling indicators—

Reasons—

Raw event stream (0)

—

IPv6 — —

—

Awaiting fingerprints… conf —

No data yet — generate TLS traffic to populate signals.

Signal breakdown (0)

Events captured—

TLS version—

QUIC seen—

HTTP/2 seen—

ALPN—

SNI—

JA3—

JA4—

JA3S / JA4S—

Anomalies—

Microsoft Smart DPI no data —

Process—

Category—

OS guess—

Residential proxy—

OpenVPN/TCP—

WireGuard—

Microsoft TLS FP—

Microsoft Guard reasons—

ntop nDPI no data —

Flows seen—

Confidence—

Detected protocols—

Categories—

VPN / anonymizer—

SNI—

JA3 / JA4—

nDPI risks—

Reasons—

ML PCAP no data —

Flows seen—

Chosen label—

Source—

Heuristic—

Model—

Top classes—

Top apps—

Top categories—

Reasons—

DNS Analytics passive sniffer · per-test awaiting —

⚡

Waiting for DNS leak-test traffic…

The collector indexes lookups of <testId>.dns6.anti.bot via your current resolver. If nothing appears, your VPN may use sealed DoH or your browser cached previous prefetches.

Queries seen—

Unique domains—

NXDOMAIN ratio—

Public resolver %—

DoT/DoH hits—

Burst (qps peak)—

Mean qname len—

Mean entropy—

Resolvers—

Top qtypes—

Recent qnames—

Tunneling indicators—

Reasons—

Raw event stream (0)

—

—

Stage 3 · Browser Probes · WebRTC · Headless

Active Deanonymization

Idle

—

Awaiting probe results… age —

Open this panel to run active probes against your browser.

Request IP—

WebRTC public IPs—

WebRTC vs request—

Headless flags—

Clock skew—

UA ↔ JA4—

User-Agent—

Languages—

Active signal breakdown (0)

Stage 10 · Reverse Recon · TCP port-scan · MTU hint awaiting —

Target IP—

Open ports—

OpenVPN (1194)—

WireGuard (51820)—

PPTP (1723)—

SOCKS (1080)—

HTTP-proxy (3128/8080/8443)—

SSH (22)—

MTU hint (TCP MSS from passive DPI)—

Concurrency (fresh flows / 60s)—

Reasons—

Stage 11 · WebRTC Deanonymizer · multi-PC ICE flood + STUN/TURN forced awaiting —

Peer connections—

Host candidates—

Server-reflexive (srflx)—

Relay (TURN)—

Private IPs leaked—

TURN relay ISP / datacenter—

ICE vs HTTP IP—

ASN match—

RTT mean / σ—

Stress (PCs / failed DCs / fail rate)—

NAT fingerprint—

Reasons—

—

Stage 14 · Browser Fingerprints · passive entropy aggregator

Browser Fingerprints

Idle

FP hash (SHA-256) —

Estimated entropy — bits

User-Agent—

Platform · OEM—

Languages—

Timezone · Offset—

Screen · DPR—

Color · Pixel · Touch—

CPU cores · device memory—

WebGL vendor—

WebGL renderer—

Canvas hash—

Audio context hash—

Fonts (heuristic)—

Plugins · MIME types—

Battery · Network—

Permissions snapshot—

—

Stage 18B · WebGL Fingerprints · CPU/GPU split scenes

WebGL Fingerprints

Idle

WebGL fingerprint · SHA-256

awaiting WebGL…

renderer — · — ms total

Recent visits with this WebGL fingerprint 0

No previous visits with this WebGL fingerprint yet.

Spoof-resistance signals 0

Probe has not run yet.

WebGL1 renderer—

WebGL2 renderer—

CPU Canvas scene—

WebGL1 GPU scene—

WebGL2 GPU scene—

CPU/GPU pixel delta—

Limits / extensions—

Shader precision—

Raw WebGL feature vector (JSON)

{}

Stage 15 · Hardware Fingerprints · CPU entropy · 10× runs · MD5

Hardware Fingerprints

Idle

CPU fingerprint · MD5

awaiting benchmark…

confidence — · — ms total · stability —

A/B/C/D hash variants — open in Chrome and Edge to compare
[A] full + caps_stable     —
[B] Edge→Chrome merged  —
[C] no GPU vendor/renderer—
[D] signature only ★ canonical—
Main MD5 above = scheme [D] (signature-only). Identical across all Chromium browsers on the same CPU. Other variants kept for comparison.

Recent visits with this CPU 0

No previous visits with this fingerprint yet.

Capabilities—

FP loop (median ms)—

Trig kernels—

Kahan vs naive Σ—

Subnormal slow-path—

Cancellation drift—

Worker oversubscription—

Raw feature vector (JSON)

{}

Stage 16 · GPU Fingerprints · WebGPU compute shaders · MD5

GPU Fingerprints

Idle

GPU fingerprint · MD5

awaiting WebGPU…

adapter — · — ms total

Recent visits with this GPU 0

No previous visits with this GPU fingerprint yet.

Adapter—

ALU FP32 (median ms)—

Memory stride—

Atomic contention—

Branch divergence—

Workgroup shape ratios—

Thermal drift—

Raw GPU feature vector (JSON)

{}

Stage 17 · Display Fingerprints · geometry · HDR · refresh · capture-truth

Monitor & Forged-Display Detection

Idle

Display fingerprint · MD5

awaiting baseline…

— ms · 0 visits with this display

Anomaly score —

Verdict —

Screen geometry—

Density (DPR · CSS res · vv)—

Color depth—

Orientation—

Gamut · dynamic-range—

Display class (scan · update)—

Multi-screen presence—

WebGL renderer—

WebGPU adapter—

Refresh estimate— (run probe)

rAF jitter / harmonics—

Window Management — physical screens

Run step-up to enumerate screens

Screen Capture truth

Run step-up to capture surface metadata

Forgery analysis · cross-layer findings

Awaiting baseline…

Raw display feature vector (JSON)

{}