If someone invests time/money in using a captcha solver, they're already dedicated enough and will easily get around a JA4 signature block.
Maybe there's some one-off exercise where this is useful, but it's very rare and I've seen people waste so much time with the whack a mole JA4 block just because they like the intellectual challenge.
It's not hard to setup JA4 monitoring and I think its valid as a coarse filter. There are various plugins for nginx/node.
I've seen people waste so much time with the whack a mole JA4 block just because they like the intellectual challenge
You just store the ja4 on requests and build a catalogue of known JA4s over time using statistics. Outlier JA4s you treat with suspicion by default and challenge. It shouldn't be manual.
If someone invests time/money in using a captcha solver, they're already dedicated enough and will easily get around a JA4 signature block.
Obviously, not for the regular user but captcha solvers are also blockable:
- proxy detection
- detection by running DNS server and capturing real IP over UDP request
- abnormal TLS handshake latency
- repeat behaviour at scale
- rendering captcha on a fake origin instead of in the real page
Comments
If someone invests time/money in using a captcha solver, they're already dedicated enough and will easily get around a JA4 signature block.
Maybe there's some one-off exercise where this is useful, but it's very rare and I've seen people waste so much time with the whack a mole JA4 block just because they like the intellectual challenge.
It's not hard to setup JA4 monitoring and I think its valid as a coarse filter. There are various plugins for nginx/node.
You just store the ja4 on requests and build a catalogue of known JA4s over time using statistics. Outlier JA4s you treat with suspicion by default and challenge. It shouldn't be manual.
Obviously, not for the regular user but captcha solvers are also blockable: - proxy detection - detection by running DNS server and capturing real IP over UDP request - abnormal TLS handshake latency - repeat behaviour at scale - rendering captcha on a fake origin instead of in the real page