One binary fp for both sides of the wire. fp get fetches a URL as a byte-exact browser · fp inspect shows a caller's JA3/JA4/JA4H/Akamai-h2 with a plain-English verdict · fp check fails CI when your client stops looking like a browser · fp guard flags non-browser inbound traffic · fp hook inspects webhooks and shows the caller's fingerprint · fp db ja4 <value> reverse-looks-up any JA4. Browser + known-client fingerprints bundled in.
Byte-exact browser TLS fingerprint (uTLS) for Go's http.Client. Beat JA3/JA4 blocking with no headless browser and no CGo. Measured parity table for Chrome/Firefox/Safari/iOS.
Deep proxy checker, scorer and rotator in one binary — the checks naive checkers skip: anonymity level (transparent/anon/elite), CONNECT tunneling, SNI-filter detection, and SOCKS5 UDP ASSOCIATE. Zero dependencies.
Build a full-text search index (SQLite FTS5 + BM25) over a website or a folder of docs — polite robots-aware crawl, text extraction, provenance back to every source, and a search CLI + read-only API. One pure-Go binary, no CGO.
Self-hostable TLS / HTTP2 fingerprint tester and differ. Reports your JA3 / JA4 / JA4H + Akamai HTTP/2 fingerprint and diffs two clients. Ships a distroless Docker image.
Open, versioned dataset of measured browser TLS (JA3/JA4) and HTTP/2 (Akamai) fingerprints, with Go and Python loaders. Schema-validated, PR-friendly, provenance-tracked.
The shield to impersonate-http's sword. A zero-dep library + reverse proxy that fingerprints inbound TLS clients (JA4 / JA4H) and enforces allow / deny / known-browser policy at the edge.
Byte-exact browser TLS (JA4) for Rust via BoringSSL — the Rust counterpart to impersonate-http. Chrome profile verified against tls.peet.ws (triple-confirmed).
How CDN / WAF / anti-bot vendors (Cloudflare, Akamai, DataDome…) treat TLS/JA4 fingerprints. Sourced, point-in-time entries with provenance on every row.
Clean-room Go implementation of the full FoxIO JA4+ suite — JA4, JA4S, JA4H, JA4L, JA4T, JA4X, JA4SSH. Zero dependencies, verified against the published spec vectors.
Drop-in anti-scraper defense for PHP: verified-crawler allowlist (FCrDNS), request heuristics, a tarpit labyrinth, and per-IP volume caps. No destructive payloads.
poolctl, p2c-sniper, tgcloak, and others — TLS cloaking, token-pool gateways, latency-focused automation.
A CDN reads your fingerprint before your HTTP request even arrives. A matching User-Agent does nothing if the handshake underneath says "library", not "browser".
| JA3 | MD5 over the TLS ClientHello. Trap: Chrome ≥110 shuffles its extension order every connection, so its JA3 is non-deterministic by design. A fixed Chrome JA3 matches almost nothing. |
| JA4 | Same idea, but extensions are sorted before hashing — so it's stable across connections. This is the one to match. |
| Akamai h2 | The HTTP/2 fingerprint: SETTINGS, window update, stream priority, pseudo-header order. Catches you even with perfect TLS — most HTTP libraries get it wrong. |
| Pure Go & Rust | Byte-exact browser TLS with no headless browser and no CGo (impersonate-http, impersonate-rs via BoringSSL). |
| Both sides | The sword and the shield — emit a fingerprint (impersonate-*) and detect one (ja4-guard). |
| Measured, not guessed | Parity tables and datasets come from real handshakes against a live reflector (fp.shshbshsnang.shop), with provenance. |
| Honest about limits | Every README says what each tool does and does not do — a careful spoofer still beats the guard, and we say so. |
Browser fingerprints go stale every release. This feed is re-measured from real browser engines every week (pipeline in fingerprint-db) — so it never rots. Pay per call with x402 (USDC on Base); no key, no sign-up.
| Free | GET https://api.shshbshsnang.shop/v1/live — current engines + freshness date. |
| $0.01 | GET /v1/profile?name=chrome — one browser's JA4 / JA3 / Akamai h2. |
| $0.05 | GET /v1/feed — the full current measured set (all engines), one call. |
Measured against the live reflector fp.shshbshsnang.shop. Engine labels are honest (Chromium ≠ Chrome stable).
| BTC | bc1q0sfghv7yfl594gjurhyhlhdgm0dtwh4dkjha36 |
| ETH / USDT-ERC20 / BNB | 0xB827b5a8B6c5111946c5D872933b2C23484E87dE |
| SOL | 3ch5aHrPp3CierhiNXmqmtFH2dMHh6Gfv7a97KtLMMCh |
| USDT-TRC20 / TRX | TUAyz7TjgJdFVD2oFHWUUTNrzzAnBRgySG |
| TON | UQAJmYVuR3hh02etjaPKJF-h6jcpdSnq9ZIFvI64NEskS6tx |