Anti.Bot

Standard Protocols

WebRTC

SCAN

QUIC

Route & Transport Consistency

MEASURING

OS Fingerprint

Detected OS:

—

Mismatch:

—

Detected DNS Servers

IP Address	Country	Provider / ASN	Network Type	Origin Score	VPN Likelihood	IP Abuse Risk	DNS Route
Testing DNS servers...

Testing DNS servers...

Detected EDNS Client Subnets

Client Subnet	Prefix Length	Resolver IP	Flag	Country
Testing EDNS...

Testing EDNS...

Full IP Information

Type	Family	IP Address	Flag	Country	City	ZIP	Time Zone	ISP / ASN	VPN	Proxy	Tor	Hosting	Fraud Score
Gathering information...

Gathering information...

Stage 4 · Verdict History · Analytics

Score History

Idle

Total—

Unique IPs—

Avg score—

With active—

Window—

Stage 5 · Mitigation offline allow

Last score—

Effectiveallow

Trust tokennone

Difficulty—

idle

clean0

susp0

likely0

bot0

unkn0

Stage 7 · Dual-Stack · IPv4 ↔ IPv6 · DPI · TURN · QUIC collecting

IPv4

IP—

Country / ASN—

ISP—

Flags—

DPI · JA4 · QUIC · H2—

Channels—

IPv6

IP—

Country / ASN—

ISP—

Flags—

DPI · JA4 · QUIC · H2—

Channels—

Mismatch: — allow

Stage 10 · Route / transport diagnostics · no VPN inference collecting —

TCP RTT—

WebRTC RTT—

WebSocket RTT—

QUIC/WT RTT—

WebRTC − TCP delta—

QUIC − TCP delta—

Exit Geo route—

Server site—

Measurement scope—

QUIC lab telemetry—

HTTP/2 ALPN seen—

QUIC version / SNI—

Reasons—

—

Stage 1 + 2 · Suricata · Score Engine · Dual-Stack

Deep Packet Inspection

Initializing…

IPv4 — —

—

Awaiting fingerprints… conf —

No data yet — generate TLS traffic to populate signals.

Signal breakdown (0)

Events captured—

TLS version—

QUIC seen—

HTTP/2 seen—

ALPN—

SNI—

JA3—

JA4—

JA3S / JA4S—

Anomalies—

Cisco Mercury no data —

Process—

Category—

OS guess—

Residential proxy—

OpenVPN/TCP—

WireGuard—

Mercury TLS FP—

Mercury reasons—

ntop nDPI no data —

Flows seen—

Confidence—

Detected protocols—

Categories—

VPN / anonymizer—

SNI—

JA3 / JA4—

nDPI risks—

Reasons—

ML PCAP no data —

Flows seen—

Chosen label—

Source—

Heuristic—

Model—

Top classes—

Top apps—

Top categories—

Reasons—

DNS Analytics passive sniffer · per-test awaiting —

⚡

Waiting for DNS leak-test traffic…

The collector indexes lookups of <testId>.dns4.anti.bot via your current resolver. If nothing appears, your VPN may use sealed DoH or your browser cached previous prefetches.

Queries seen—

Observed unique domains—

NXDOMAIN ratio—

Public resolver %—

DoT/DoH hits—

Observed burst (qps peak)—

Observed mean qname len—

Observed mean entropy—

Resolvers—

Top qtypes—

Recent qnames—

Tunneling indicators—

Reasons—

Raw event stream (0)

—

IPv6 — —

—

Awaiting fingerprints… conf —

No data yet — generate TLS traffic to populate signals.

Signal breakdown (0)

Events captured—

TLS version—

QUIC seen—

HTTP/2 seen—

ALPN—

SNI—

JA3—

JA4—

JA3S / JA4S—

Anomalies—

Cisco Mercury no data —

Process—

Category—

OS guess—

Residential proxy—

OpenVPN/TCP—

WireGuard—

Mercury TLS FP—

Mercury reasons—

ntop nDPI no data —

Flows seen—

Confidence—

Detected protocols—

Categories—

VPN / anonymizer—

SNI—

JA3 / JA4—

nDPI risks—

Reasons—

ML PCAP no data —

Flows seen—

Chosen label—

Source—

Heuristic—

Model—

Top classes—

Top apps—

Top categories—

Reasons—

DNS Analytics passive sniffer · per-test awaiting —

⚡

Waiting for DNS leak-test traffic…

The collector indexes lookups of <testId>.dns6.anti.bot via your current resolver. If nothing appears, your VPN may use sealed DoH or your browser cached previous prefetches.

Queries seen—

Observed unique domains—

NXDOMAIN ratio—

Public resolver %—

DoT/DoH hits—

Observed burst (qps peak)—

Observed mean qname len—

Observed mean entropy—

Resolvers—

Top qtypes—

Recent qnames—

Tunneling indicators—

Reasons—

Raw event stream (0)

—

—

Stage 3 · Browser Probes · WebRTC · Headless

Active Network & Browser Consistency

Idle

An initial browser consistency probe and one rate-limited reverse service check start automatically after first-party IP discovery. Checks use anti.bot infrastructure and are restricted to your currently observed exit IP; opening this panel enables refresh.

—

Awaiting probe results… age —

Open this panel to run active probes against your browser.

Request IP—

WebRTC public IPs—

WebRTC vs request—

Headless flags—

Clock skew—

UA ↔ JA4—

User-Agent—

Languages—

Active signal breakdown (0 hits / 0 checked)

Stage 10 · Active Service Exposure · protocol-aware TCP checks queued —

Target IP—

Open ports—

OpenVPN (1194)—

WireGuard / UDP tunnelsnot testable from browser traffic

PPTP (1723)—

SOCKS (1080)—

HTTP CONNECT (3128/8080)—

SSH (22)—

Network origin context—

Observed TCP packet-size envelope (not SYN MSS)—

Concurrency (fresh flows / 60s)—

Reasons—

Stage 11 · WebRTC Network Consistency · STUN/TURN path comparison awaiting —

Peer connections—

Host candidates—

Server-reflexive (srflx)—

Relay (TURN)—

Private IPs leaked—

TURN relay ISP / datacenter—

STUN ↔ TURN client path—

WebRTC route location—

ICE vs HTTP IP—

ASN match—

RTT mean / σ—

Stress (PCs / failed DCs / fail rate)—

NAT fingerprint—

v5 simultaneous proofshadow · awaiting

Direct + TURN overlap—

Server transcript—

Receipt boundaryapplication-correlated

Reasons—

—

Stage 14 · Browser Fingerprints · passive entropy aggregator

Browser Fingerprints

Idle

FP hash (SHA-256) —

Estimated entropy — bits

User-Agent—

Platform · OEM—

Languages—

Timezone · Offset—

Screen · DPR—

Color · Pixel · Touch—

CPU cores · device memory—

WebGL vendor—

WebGL renderer—

Canvas hash—

Audio context hash—

Fonts (heuristic)—

Plugins · MIME types—

Battery · Network—

Permissions snapshot—

—

Deterministic Surface Consistency · one scene · three browser APIs

Canvas2D ↔ WebGL1 ↔ WebGL2

queued

The same bounded vector scene is rendered by each real browser API. There is no “Canvas 3D” API; WebGL1 and WebGL2 are compared explicitly. Exact hashes, perceptual distance and pixel error are shown separately.

Awaiting one-shot comparison…

Canvas2D

SHA-256: —
dHash: —
Repeat stability: —
Visible alpha: —
Render + readback: —

WebGL1

SHA-256: —
dHash: —
Repeat stability: —
Visible alpha: —
Render + readback: —

WebGL2

SHA-256: —
dHash: —
Repeat stability: —
Visible alpha: —
Render + readback: —

Canvas2D ↔ WebGL1—

Canvas2D ↔ WebGL2—

WebGL1 ↔ WebGL2—

Raw comparison metrics (JSON)

{}

Stage 18B · WebGL Fingerprints · CPU/GPU split scenes

WebGL Fingerprints

Idle

WebGL fingerprint · SHA-256

awaiting WebGL…

renderer — · — ms total

Recent visits with this WebGL fingerprint 0

No previous visits with this WebGL fingerprint yet.

Spoof-resistance signals 0

Probe has not run yet.

WebGL1 renderer—

WebGL2 renderer—

CPU Canvas scene—

WebGL1 GPU scene—

WebGL2 GPU scene—

CPU/GPU pixel delta—

Limits / extensions—

Shader precision—

WebGL1 measured curveawaiting bounded measurement

WebGL2 measured curveawaiting bounded measurement

GPU path interpretationMeasured telemetry only · hardware authenticity is not calibrated

Raw WebGL feature vector + uncalibrated timing telemetry (JSON)

{}

Stage 15 · session-seeded runtime integrity · 21-operation FPU signature · bounded CPU-family inference

CPU / FPU Runtime Analysis

Idle

Browser JavaScript cannot read CPUID, CCD topology or identify the exact processor model. These results describe the browser runtime, math library and coarse performance family—not silicon identity.

FPU / libm signature · SHA-256 awaiting 21 operations… repeat stability —

CPU family candidate unknown heuristic confidence —

Model boundary / OOD not evaluated Exact model deliberately remains unavailable

Runtime integrity · challenge bound not assessed shadow score — · reference fleet pending

Compatibility runtime signature · MD5

awaiting benchmark…

confidence — · — ms total · stability —

This session · same runtime signature 0

No earlier sample in this short-lived session.

Capabilities—

FP loop (median ms)—

Trig kernels—

Kahan vs naive Σ—

Subnormal slow-path—

Cancellation drift—

Bounded worker topology—

1/2/4/8 fixed-work scaling—

Math native surface—

Main ↔ Worker parity—

WASM capability / error tuple—

Runtime realm consistency—

Stack / toString meta-surface—

CSS Typed OM math path—

21 IEEE-754 output values and scope

Runtime/libm scope awaiting measurement.

[]

Session-seeded integrity evidence

One-time Math/tanh inputs, native descriptors, WASM capability/error tuple, realm parity and main↔Worker bit parity. Missing optional surfaces remain unknown; performance and capability cohorts stay shadow-only until reference-fleet calibration.

{}

Compatibility variants and raw benchmark vector

A/B/C/D comparison variants

[A] full + stable capabilities—

[B] Chromium-brand normalized—

[C] GPU fields excluded—

[D] compatibility signature—

Variants compare runtime normalization choices; they do not prove a physical CPU.

{}

Passive APIs only · no USB/HID/Serial chooser dialogs

Detected Hardware & Capabilities

Passive

Collecting browser-exposed hardware classes…

Logical processors—

Coarsened device memory—

UA-CH architecture / bitness—

Current display—

Origin storage quota—

WebGL adapter—

WebGPU adapter—

Permission-gated device APIs—

Physical disks, monitor model and USB device identities are unavailable without explicit browser permission; this page never opens a chooser automatically.

Complete passive inventory (JSON)

{}

Stage 16 · GPU Fingerprints · WebGPU compute shaders · MD5

GPU Fingerprints

Idle

GPU fingerprint · MD5

awaiting WebGPU…

adapter — · — ms total

Recent visits with this GPU 0

No previous visits with this GPU fingerprint yet.

Adapter—

ALU FP32 (median ms)—

Memory stride—

Atomic contention—

Branch divergence—

Workgroup shape ratios—

Thermal drift—

Raw GPU feature vector (JSON)

{}

Stage 17 · Display Fingerprints · geometry · HDR · refresh · capture-truth

Monitor & Forged-Display Detection

Idle

Display fingerprint · MD5

awaiting baseline…

— ms · 0 visits with this display

Anomaly score —

Verdict —

Screen geometry—

Density (DPR · CSS res · vv)—

Color depth—

Orientation—

Gamut · dynamic-range—

Display class (scan · update)—

Multi-screen presence—

WebGL renderer—

WebGPU adapter—

Refresh estimate— (run probe)

rAF jitter / harmonics—

Window Management — physical screens

Run step-up to enumerate screens

Screen Capture truth

Run step-up to capture surface metadata

Forgery analysis · cross-layer findings

Awaiting baseline…

Raw display feature vector (JSON)

{}

Standard Protocols

WebRTC

QUIC

Route & Transport Consistency

OS Fingerprint

Detected DNS Servers

Detected EDNS Client Subnets

Full IP Information

Score History

Deep Packet Inspection

Active Network & Browser Consistency

Browser Fingerprints

Canvas2D ↔ WebGL1 ↔ WebGL2

Canvas2D

WebGL1

WebGL2

WebGL Fingerprints

CPU / FPU Runtime Analysis

Detected Hardware & Capabilities

GPU Fingerprints

Monitor & Forged-Display Detection

Data Sources

About