Bot Signature

The foundation of passive OS fingerprinting, analyzing network-layer parameters that are difficult for bots to modify without kernel-level access.

• Initial TTL (Time-to-Live): The starting value decremented by each hop. Linux bots typically use 64, Windows uses 128, and embedded devices may use 255.
• TCP Window Size: The receive buffer size advertised in the SYN packet. This value is often unique to specific OS versions and kernel configurations.
• Don't Fragment (DF) Flag: Whether the IP packet sets the DF bit, a behavior that varies predictably across operating systems.
• TCP Options Ordering: The sequence and values of options like Maximum Segment Size (MSS), Window Scale, and Selective Acknowledgments (SACK) form a distinctive stack signature.

The TLS Client Hello message reveals the client's capabilities before any encrypted channel is established. JA4 is the modern standardized method for hashing these parameters into a compact fingerprint.

• Cipher Suite Order: The prioritized list of cryptographic algorithms the client supports. Bots often use a limited, library-default set distinct from browsers.
• Supported Extensions: The specific TLS extensions and their order, such as Server Name Indication (SNI), Application-Layer Protocol Negotiation (ALPN), and supported groups.
• Elliptic Curve Preferences: The named curves the client offers for key exchange. Common browser curves differ from those in Python's requests library or Go's crypto/tls.
• GREASE Values: Legitimate browsers inject random, invalid extension IDs to prevent protocol ossification. The absence of GREASE is a strong indicator of automation.

The sequence, casing, and presence of HTTP request headers create a high-level signature that varies significantly between browser engines and HTTP client libraries.

• Header Ordering: Browsers send headers in a specific, engine-defined sequence (e.g., Host, Connection, sec-ch-ua, User-Agent). Python's requests library uses an entirely different, alphabetical order.
• Header Casing: Variations like Content-Type vs. Content-type are library-specific artifacts.
• Accept-Language Precision: Bots often send generic en-US or * values, while real browsers transmit nuanced, user-configured language quality values (q-factors).
• Connection Header: The presence and value of Connection: keep-alive and related keep-alive headers differ between persistent browser sessions and stateless scripted requests.

Modern protocols expose additional fingerprinting surfaces through their connection-level settings and frame sequencing.

• SETTINGS Frame Values: HTTP/2 clients exchange a SETTINGS frame immediately after the preface. The specific parameters (e.g., SETTINGS_MAX_CONCURRENT_STREAMS, SETTINGS_INITIAL_WINDOW_SIZE) and their values are highly characteristic of the client library.
• Stream Prioritization: The weight and dependency tree logic used to prioritize resource loading. Browsers implement complex, heuristic-based trees; scripts rarely implement prioritization at all.
• Pseudo-Header Order: The sequence of :method, :path, :scheme, and :authority pseudo-headers is strictly defined but can vary in edge cases across implementations.
• QUIC Version Negotiation: For HTTP/3, the specific QUIC transport parameters and version negotiation behavior provide additional fingerprinting data.

When a bot executes JavaScript, the headless browser or automation framework leaks detectable artifacts into the runtime environment.

• Navigator.Webdriver: The navigator.webdriver property is set to true by default in Selenium, Puppeteer, and Playwright. This is the most basic and widely checked automation signal.
• Navigator Plugins & MIME Types: Headless browsers often report an empty or minimal plugin array, whereas real browsers list PDF viewers, Chrome PDF Plugin, etc.
• WebGL Vendor & Renderer: The GPU vendor string and renderer identifier in headless mode often default to generic values like "Google Inc." with "SwiftShader" rather than the actual hardware.
• Prototype Chain Integrity: Automation tools sometimes modify native browser APIs. Checking toString() on functions or inspecting prototype chains can reveal monkey-patched methods.

Beyond static fingerprints, the dynamic behavior of a session provides a continuous signature that is difficult to simulate convincingly.

• Request Inter-Arrival Time: Bots typically exhibit unnaturally consistent delays or extremely high request velocities. Human traffic follows stochastic, bursty patterns.
• URL Traversal Logic: Bots often traverse links in sequential, depth-first, or breadth-first patterns. Humans navigate non-linearly, revisiting pages and following tangential links.
• Mouse Movement & Keystroke Dynamics: When interaction data is available, bots generate perfectly linear mouse paths or instant keystrokes, lacking the micro-hesitations and acceleration curves of human input.
• Session Depth & Bounce Patterns: Automated sessions may fetch every link on a page without dwell time, creating a flat, high-depth session profile distinct from focused human browsing.