Alternatives
Products that do what WebDecoy does
The bot detection layer your stack is missing.
- 1IA
IPDetective collects data from about 60+ different sources such as official cloud provider endpoints and public VPN/Proxy/Tor/Bot net lists. Then aggregates this data into a fast and easy to use API that can be integrated into applications or scripts easily. IPDetective started as a hobby project for my other hobby projects :) and I decided to wrap a simple website around and offer it as a service. Let me know what your thoughts, if you find value in this service or if you have any feature requests.
2022 · ipdetective.io
- 2DA
2024 · github.com
- 3AO
This is a small PoC Python project for web server access logs analyzing to classify and dynamically block bad bots, such as L7 (application-level) DDoS bots, web scrappers and so on. We'll be happy to gather initial feedback on usability and features, especialy from people having good or bad experience wit bots. *Requirements* The analyzer relies on 3 Tempesta FW specific features which you still can get with other HTTP servers or accelerators: 1. JA5 client fingerprinting (https://tempesta-tech.com/knowledge-base/Traffic-Filtering-b...). This is a HTTP and TLS layers…
Oct 2025 · github.com
- 4
- 5
- 6WB
Jul 2026 · honeypotlive.cc
- 7MS
I noticed the growing security concerns around MCP (https://news.ycombinator.com/item?id=43600192) and built an open source tool that can detect several patterns of tool poisoning attacks, exfiltration channels and cross-origin manipulations. MCP-Shield scans your installed servers (Cursor, Claude Desktop, etc.) and shows what each tool is trying to do at the instruction level, beyond just the API surface. It catches hidden instructions that try to read sensitive files, shadow other tools' behavior, or exfiltrate data. Example of what it detects: - Hidden instructions…
2025 · github.com
- 8
- 9FB
I've published an open specification for a detection method I'm calling RQ4 (Request Context Fingerprinting). It analyzes whether HTTP request headers are logically consistent with real browser behavior - not just what headers are present, but whether they make sense together given the request context.
Mar 2026 · github.com
- 10IB
BoringSSL and nghttp2. Matches JA3N, JA4, and JA4_R fingerprints. Supports HTTP/2, async/await, and works with Cloudflare-protected sites. Not trying to compete with curl_cffi - just a learning project that turned into something functional.
Nov 2025 · github.com
- 11SW
[I'm the author] Spall is a web-accessible profiler that I made to help my web-dev friends load gigabyte+ JSON traces without lunch-break-long load times. Recently, Spall got experimental support for auto-tracing with binary traces (along with an in-progress native-port, to give it more memory headroom), which was used to help track down and fix some hard-to-spot lock contention issues in the Odin-language compiler. I demoed it at the Handmade Seattle conference in October, https://guide.handmade-seattle.com/c/2022/spall/, with a head-to-head against Perfetto,…
2023 · gravitymoth.com
- 12BB
This is a simple single-file python program that can find basic XSS (cross-site scripting) vulnerabilities in a target url. Most XSS discovery tools use a payload refelection strategy in which payloads are injected in url parameters and the GET response is inspected for places where the payload content is reflected. This is a very low precision XSS detection strategy because most reflection does not support execution. This program uses a different approach, and instead opens the target url in a browser, tests alert(...) payloads directly in the browser context, and listens for an alert being…
2024 · github.com
- 13UL
Hi Hacker News! We’re Vadim and Chris from Highlight.io [1]. We do web app monitoring and are working on using LLMs/embeddings to add new functionality to our error monitoring product. Given that there’s a lot of founders/engineers using LLMs in their products, we figured we’d share how we built the new functionality, their impact on our workflows, and how you can try it out. Our goal was to build two features: (1) tagging errors (e.g. deeming an error as “authentication error” or a “database error”); and (2) grouping similar errors together (e.g. two errors that have a different…
2023 · github.com
- 14
Detect any website's tech stack with a single API call
Feb 2026 · detectzestack.com
- 15KD
I built this after seeing multiple teams accidentally ship API keys in their frontend code. The problem: Modern web development moves fast. You're vibe-coding, shipping features, and suddenly your AWS keys are sitting in a tag visible to anyone who opens DevTools. I've personally witnessed this happen to at least 3-4 production apps in the past year alone. KeyLeak Detector runs through your site (headless browser + network interception) and checks for 50+ types of leaked secrets: AWS/Google keys, Stripe tokens, database connection strings, LLM API keys (OpenAI, Claude, etc.), JWT…
Nov 2025 · github.com
- 16CH
There is a growing number of companies offering anti-bot protection SaaS to protect websites from scraping by automated bots based on Puppeteer/Selenium. Most of them rely on browser properties such as headers, javascript properties (window., navigator.), behavior analysis, to build device/user fingerprints and match it against a database of "whitelisted" fingerprints (typical user behavior/settings/device props etc). For the past few months, together with two other devs I have worked on a customized Puppeteer/Playwright scraping backend. It's essentially a drop-in…
2021
- 17CB
Not new but quite cool. Note: https://creepjs.org/ is NOT official the repo is https://github.com/abrahamjuliot/creepjs Anyone knows how fingerprinting works mathematically? what do they use? when the signals may vary even slightly, your final hash should be sufficiently accurate and stable. A simple hash won't do it. Changing IP, missing cookies/session, resizing window, TLS/SSL browser handshake, screen depth, font rendering, MTR, network latency if you want to measure, etc... any signal alone means little but as a whole mathematically what is…
Apr 2026 · abrahamjuliot.github.io
- 18DC
2018 · github.com
- 19CP
Hi HN, I built CountermarkAI, a lightweight anti-scraping & bot-detection tool for content creators and website owners. It’s designed to help protect your work from unauthorized scraping and AI training, that repurposed your work without permission. How It Works: Use Hashtag – Creators add a unique hashtag to their content as a declaration of ownership. Protect Website – For those running your own sites, simply add a small snippet to your . The protect.js script works asynchronously by sending metadata from every page load back to our servers, logging requests, and flagging known AI-training…
2025 · countermarkai.com
- 20
A local MITM proxy that lets you control TLS fingerprints (JA3/JA4), HTTP/2 fingerprints, HTTP header order, and User-Agent — all from a single YAML config file. - ytkoka/impersonate-proxy
20d ago · github.com
- 21
7 website intelligence tools in 1 affordable API
Apr 2026 · detectzestack.com
- 22
- 23BD
2016 · npmjs.com
- 24RS
Hi HN, we're Mayank and Matt of Roundtable (https://www.roundtable.ai). We launched our Survey Simulator as part of YC S23 (see Launch HN: https://news.ycombinator.com/item?id=36865625), and ultimately decided to pivot because we couldn't convince users to trust our results and our value proposition wasn't clear. We conducted tons of user discovery interviews, and a lot of big players talked about the pain of manual QC and bot detection. We launched a survey fraud and bot detection API (Alias; docs.roundtable.ai) that determines whether a bot is answering your survey…
2024
Ranked by how close each launch is in meaning, then by votes. Refine with a description →