Mind sharing the link here?
Also, what are the signatures that Google uses to identify the browser?
Hi there,
There is no link, I am running it on my own server, the testing logic is done, it runs, you can drop me a couple 10 or 100 IPS Ill check them for free for you. The front end stands, the database is done, the back end is done, the API I am doing now, therell be 2 or 4 APIs(I wanna hide where the requests are going and where the responses are coming from) , so that is the current status, but yes, it runs in terminal for now, I wanted to see how the feedback is, the end users sure will be very interested and proxy provider SHOULD be, they can simply segregate the premium IP to sticky sessions and then the not perfect ones to rotating tasks and the bad ones, well, get rid of them, this should keep everyone involved clean and perhaps will expose one or 2 affiliates who deliver bad proxies(seen many dongle based one, amazon fire sticks and such).
Google, how they identify the browser, well, in ML case, the MLX folder name is spilled to network for one, so they do not even need to do much for that. Then, upon first interaction, they can measure how and how fast extensions are loaded, here they also get the usual TCP and l7 info, but more interesting vectors are:
TLS fingerprinting (JA3/JA3S like patterns), the exact TLS ciphers, extensions and handshake order create a fingerprint that can distinguish stock Chrome from custom clients.
Headers and UA information, this is more complicated to manually set up than people think and the anti detect browsers do a pretty bad job at this, they try to make sure pixelscan is passed, but theyre affiliated with them and pixelscan isnt even good at this, pixelscan is "who are you", while TCP is "where you from". So I will leave the easy and obvious parts out here and focus on the more complicated stuff, because Chrome doesnt particularly care about red flags in headers and such, unless its extremly obvious. They just lower the trust score to the profile to a degree where everything is a recaptcha and qr code.
Keep in mind the below info is from Google themselves:
Proxy and reverse‑proxy ports and behavior ,common abuse ports, chain length, visible hop-count.
Cookies and first‑party identifiers , Google cookies, SID, other persistent IDs. Then presence/absence, stale/odd values, or sudden cookies from unrelated geos matter.
Timezone, locale, language and daylight saving offsets.(!!!)
Installed fonts and font rendering, returns differences across platforms and installs. This goes way way beyond just which fonts are installed.
Plugins and mimeTypes (less useful now but but good enough to detect multlogin).
Past abuse reports and threat intel feeds,like Spamhaus listings, phishing&abuse feeds, and reported abuse tied to IPs or ASNs (some of these I get my info for the bot).
And the most difficult ones would be:
Mouse+touch+keyboard event patterns, pointer timing and jitter, scroll patterns, focus+blur behavior aka micro timing
JS execution timing and performance metrics (how long certain DOM/JS operations take) can indicate headless or instrumented(this is basically an anti detect fork) runtimes.
