Hacker News: avastel

A live browser fingerprinting and bot detection playground

avastel — Wed, 19 Aug 2026 09:36:04 +0000

Article URL: https://fingerprint-scan.com/

Comments URL: https://news.ycombinator.com/item?id=49359153

Points: 2

# Comments: 1

GPU-Based Device Fingerprinting

avastel — Mon, 17 Aug 2026 07:48:56 +0000

Article URL: https://shaderghost.gg/

Comments URL: https://news.ycombinator.com/item?id=49327627

Points: 2

# Comments: 0

Fingerprint Harvesting in the Bot Ecosystem

avastel — Wed, 22 Apr 2026 12:02:19 +0000

Article URL: https://castle.io/research/fingerprint-harvesting-in-the-bot-ecosystem/

Comments URL: https://news.ycombinator.com/item?id=47862372

Points: 2

# Comments: 0

BotmasterLabs: Powering an Era of Spam

avastel — Tue, 24 Mar 2026 13:19:40 +0000

Article URL: https://castle.io/research/botmasterlabs-powering-an-era-of-spam/

Comments URL: https://news.ycombinator.com/item?id=47502168

Points: 1

# Comments: 0

Inside a bot operator's email verification infrastructure

avastel — Tue, 10 Mar 2026 13:18:58 +0000

Article URL: https://blog.castle.io/inside-a-bot-operators-email-verification-infrastructure/

Comments URL: https://news.ycombinator.com/item?id=47322888

Points: 3

# Comments: 0

Account enumeration in the wild: analyzing a real-world Spotify enumeration tool

avastel — Thu, 05 Mar 2026 12:51:56 +0000

Article URL: https://blog.castle.io/account-enumeration-in-the-wild-analyzing-a-real-world-spotify-enumeration-tool/

Comments URL: https://news.ycombinator.com/item?id=47261040

Points: 2

# Comments: 0

New comment by avastel in "FPScanner – open-source browser fingerprinting and bot detection library"

avastel — Sat, 21 Feb 2026 15:04:36 +0000

Author here.

I first built FPScanner during my PhD around 2017–2018, when I was doing research on browser fingerprinting and bot detection. After that I did not really maintain it for years.

I recently decided to revive it because things changed a lot. Automation is much easier now. With free automation libraries like Puppeteer/Playwright/Selenium + headless Chrome and cheap proxies, you can build decent bots very quickly. At the same time, open source defensive tooling is still quite limited, or very basic.

To be clear, FPScanner is not trying to be a silver bullet.

It is a small, self-hosted library that focuses on deterministic client-side signals: - webdriver and automation flags - CDP-related artifacts - automation framework markers (Selenium, Playwright, etc.) - JS cross-context inconsistencies: main JS context, iframes and workers

It also generates a JA4-inspired fingerprint ID for clustering sessions, and includes encrypted payload + simple anti-replay protections.

There is no ML here, no "AI detection", and no claim to block 100% of bots. The idea is just to expose strong, explainable signals and make automation a bit more expensive. I assume attackers can read the source code.

I tested it on different devices and browsers to avoid JS errors and obvious false positives, but I’m sure there are edge cases. If you try it on less common browsers or hardened setups and it breaks, please let me know or open an issue.

Happy to answer questions or discuss design choices / limitations.

FPScanner – open-source browser fingerprinting and bot detection library

avastel — Sat, 21 Feb 2026 15:01:30 +0000

Article URL: https://github.com/antoinevastel/fpscanner

Comments URL: https://news.ycombinator.com/item?id=47101452

Points: 3

# Comments: 1

New comment by avastel in "LinkedIn checks for 2953 browser extensions"

avastel — Thu, 05 Feb 2026 21:27:16 +0000

I wrote a blog post recently about the technique used by LinkedIn to do extension probing, as well as other ways to do it with less side effects

https://blog.castle.io/detecting-browser-extensions-for-bot-...

New comment by avastel in "Disrupting the largest residential proxy network"

avastel — Sat, 31 Jan 2026 18:01:31 +0000

Since I was also tracking this proxy network as part of my side project, I wrote a short blog post + give access to 16m+ proxy IPs IoCs that belong to this proxy network: https://deviceandbrowserinfo.com/learning_zone/articles/insi...

Note that even after the disruption, I'm still able to route millions of requests/day through IP IDEA's network

New comment by avastel in "Disrupting the largest residential proxy network"

avastel — Thu, 29 Jan 2026 10:37:41 +0000

Disrupting the Largest Residential Proxy Network

avastel — Thu, 29 Jan 2026 10:04:12 +0000

Article URL: https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network

Comments URL: https://news.ycombinator.com/item?id=46808018

Points: 8

# Comments: 1

Inside the IPIDEA residential proxy network disrupted by Google

avastel — Thu, 29 Jan 2026 08:31:04 +0000

Article URL: https://deviceandbrowserinfo.com/learning_zone/articles/inside-ipidea-residential-proxy-network

Comments URL: https://news.ycombinator.com/item?id=46807320

Points: 2

# Comments: 0

You see an email ending in .eu.org. Must be legit, right?

avastel — Tue, 27 Jan 2026 13:39:38 +0000

Article URL: https://blog.castle.io/you-see-an-email-ending-in-eu-org-must-be-legit-right/

Comments URL: https://news.ycombinator.com/item?id=46779765

Points: 1

# Comments: 0

Detecting browser extensions for bot detection, lessons from LinkedIn and Castle

avastel — Wed, 14 Jan 2026 08:31:31 +0000

Article URL: https://blog.castle.io/detecting-browser-extensions-for-bot-detection-lessons-from-linkedin-and-castle/

Comments URL: https://news.ycombinator.com/item?id=46613690

Points: 2

# Comments: 0

Roll your own bot detection: server-side detection

avastel — Wed, 15 Oct 2025 09:23:49 +0000

Article URL: https://blog.castle.io/roll-your-own-bot-detection-server-side-detection-part-2/

Comments URL: https://news.ycombinator.com/item?id=45589939

Points: 1

# Comments: 1

Roll your own bot detection: fingerprinting/JavaScript

avastel — Wed, 08 Oct 2025 07:58:38 +0000

Article URL: https://blog.castle.io/roll-your-own-bot-detection-fingerprinting-javascript-part-1/

Comments URL: https://news.ycombinator.com/item?id=45513356

Points: 3

# Comments: 0

New comment by avastel in "Browser Fingerprint Detector"

avastel — Mon, 08 Sep 2025 17:08:31 +0000

I recently wrote about the limits of these kinds of fingerprinting tests. They tend to overly focus on uniqueness without taking into account stability. Moreover sample size is often really small which tends to artificially make a lot of users unique

https://blog.castle.io/what-browser-fingerprinting-tests-lik...

New comment by avastel in "Why a classic CDP bot detection signal suddenly stopped working"

avastel — Thu, 28 Aug 2025 14:03:02 +0000

(Author here) TBH I don't think the main goal of Google was to make bots undetectable. It was more a side effect of preventing side effects while reviewing errors in the devtools: https://source.chromium.org/chromium/_/chromium/v8/v8/+/e08e...

It was the same when Google released the new headless Chrome a few years ago: https://antoinevastel.com/bot%20detection/2023/02/19/new-hea... It made vanilla/naive bots more realistic/detectable by default.

Why a classic CDP bot detection signal suddenly stopped working

avastel — Thu, 28 Aug 2025 13:07:14 +0000

Article URL: https://blog.castle.io/why-a-classic-cdp-bot-detection-signal-suddenly-stopped-working-and-nobody-noticed/

Comments URL: https://news.ycombinator.com/item?id=45051700

Points: 3

# Comments: 2