@ricardo The whole fingerprint benefit is you don’t have to worry about the IP address or the network of the client, only the IP packet structure. That helps filtering real users requests from RP tunneled requests. Whatever connection is used, going through a RP-enabled app will always add overhead and change packet metrics compared to the legit client using that connection (Tor being an exception apparently, as packets fingerprints from a Tor exit node will match RP packets fingerprints).The real trick unfortunately is to be able to do the analysis in real time as the packet comes in and take a block/pass decision immediately. So it’s best suited for firewall appliance, WAF, or integrated inside the server (HAproxy, or a patched Nginx for example, support JA4+).Also, it has to be correlated with other data. A comprehensive example can be found here: https://webdecoy.com/blog/ja4-fingerprinting-ai-scrapers-practical-guide/The more I read about it, the less I expect being able to use it in a home-made protection system, but the more I want to dig in at work as our big firewalls apparently do support JA4+.@feld @dch @lw @stefano
