Recent content by Zl0y

Yeah, sure, DM me. I'll try to help

We have our own in-house development (on ja3+http2 change). We do not use public repositories

And you're a security expert?)

Yes, it's the eternal confrontation between sides of specialists :). I disagree) If everything is already done, then why are there still various gray/black schemes? )

Finally I found like-minded people :) I have long ago started to notice that sites that have AWS protection they look at ja3 +http2 fingerprints and ban on them. I've thrown together a little note on how to detect WAF on the site you're working with. How to easily and simply determine what...

No, it's not just that. There's usually an anti-fraud system. It has some kind of point system. And for every inconsistency in the parameters, it throws in frod score. For example: You have a proxy running on a WIndows OS. - It will have a Windows TCP fingerprint. And when you connect to...

This is not true, a VPN or proxy cannot affect SSL\TLS fingerprints - as they are on different network layers of the standard OSI model. TLS fingerprints are affected by your browser, but not by proxy or VPN. (properly called JA3,JA4, etc). VPNs and proxies can only affect TCP\IP fingerprints

Thank you for your reply. Can you tell me what the blocking was about and how you realized that it was related to TLS?

Changing the programming language does not help in any way to bypass blocking.

Have you encountered this type of defense in the wilderness? If yes, at which sites. And what did you do to bypass this defense. Interesting. Thank you

If you don't change your browser (Chrome / Firefox / Safari) - your TLS fingerprint will always be the same - systems like AWS and Google see it perfectly. That's why you either need to change browsers (not through anti-detect browser) or use special software to change TLS + HTTP2 fingerprints.

These are called ja3 prints, (ja4 is a newer analog) here's how they work https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967/ To summarize. Here is a list of what it is formed from (from the first ClientHello packet in a TLS connection): TLS Version Cipher...

I'm pretty sure you're being detected by the ja3 print. Amazon themselves have written that they've implemented this detection method. https://aws.amazon.com/ru/about-aws/whats-new/2023/09/aws-waf-ja3-fingerprint-match/ And what you're describing fits the ja3 detection. In short, for example...

I think in your case you could buy an individual home VPN (say for $50-100$) and use it for a year or two. They do exist. Then you will save a lot on distance. And paypal service will not block you for frequent IP address changes. Thus you get a reliable proxy for 5$ a month or so - the main...

Can you please tell me if the TSP options, tos, mtu will be the ones we give you or will they be yours? That is, can your proxies take the values of the above parameters from the packets I send?