Fingerprinting browser-impersonating bots w/o JavaScript (open spec)
I've published an open specification for a detection method I'm calling RQ4 (Request Context Fingerprinting). It analyzes whether HTTP request headers are logically consistent with real browser behavior - not just what headers are present, but whether they make sense together given the request context.
Fingerprinting browser-impersonating bots w/o JavaScript (open spec) launched on March 31, 2026 with 6 votes, #1,631 of 23,380 launches that month and more than 75% of that year's launches.
What it does
RQ4: Request Context Fingerprinting - detect browser-impersonating bots via HTTP header context analysis - rozetyp/rq4
Detect browser-impersonating bots by analyzing whether HTTP headers are logically consistent with real browser behavior. RQ4 is an open standard for fingerprinting HTTP clients based on request context validity. It produces a 4-character fingerprint ( vvvv , xvvx , ---- ) indicating whether the request's headers could have been generated by a real browser. Modern bot tooling can perfectly replicate browser TLS fingerprints (defeating JA3/JA4) and copy browser header sets (defeating JA4H). But these tools set headers statically — the same navigation headers on every request regardless of context. Real browsers are state machines that generate different headers for page loads vs. API calls,…from github.com
Does a similar job
all alternatives →
I built an HTTP client that perfectly mimics Chrome 142Nov 2025 · github.com · ▲39BoringSSL and nghttp2. Matches JA3N, JA4, and JA4_R fingerprints. Supports HTTP/2, async/await, and works with Cloudflare-protected sites. Not trying to compete with curl_cffi - just a learning project that turned into something functional.
A local MitM proxy to control TLS fingerprintsAug 2026 · github.com · ▲29A local MITM proxy that lets you control TLS fingerprints (JA3/JA4), HTTP/2 fingerprints, HTTP header order, and User-Agent — all from a single YAML config file. - ytkoka/impersonate-proxy
An open source access logs analytics script to block bot attacks2025 · github.com · ▲37This is a small PoC Python project for web server access logs analyzing to classify and dynamically block bad bots, such as L7 (application-level) DDoS bots, web scrappers and so on. We'll be happy to gather initial feedback on usability and features, especialy from people having good or bad experience wit bots. *Requirements* The analyzer relies on 3 Tempesta FW specific features which you still can get with other HTTP servers or accelerators: 1. JA5 client fingerprinting (https://tempesta-tech.com/knowledge-base/Traffic-Filtering-b...). This is a HTTP and TLS layers…
More life & fun this month
the category →
A free city-building game in your browser. You are the mayor. You know what the city needs. Now get it past the zoning board, the neighbors, the appeals court and the next election.
Life & fun · 2d ago · permit.petercai.com
- IV
Life & fun · 14d ago · tanzaniaeducationproject.org
Turn a phone, tablet or TV into a sign. Type a message and it fills the screen: welcome signs, timers, Wi-Fi passwords and more. No app, no account, free.
Life & fun · 15d ago · bigwords.page
Play a free virtual guitar online with your keyboard or by touch. Slow songs down and see every chord, string and strum. Acoustic, classic, electric and bass.
Life & fun · 9d ago · guitoro.com
Carrier settings from iPhone, Pixel and Galaxy firmware, decoded and compared: APNs, VoLTE, 5G and Wi-Fi Calling per carrier, and what each build changed.
Life & fun · 13d ago · carrierexplode.com
Life & fun · 23d ago · space.bl2.net
Source: Show HN post ↗
Launched alongside, March 2026
the whole month →
Switch from ChatGPT to Claude with import memory feature
AI · Mar 2026 · claude.com
Littlebird▲709Littlebird remembers everything across your meetings, messages, docs, and apps, then takes action so you can recall any detail and never lose context.
AI · Mar 2026 · littlebird.ai
