Latest / Logosofia no Dia a Dia
Inside Cloudflare's Bot Check: TLS, JA4, and the Sand-Timer
That grey page with the spinning circle — "Checking your browser before accessing" — hides a two-layer detection system that has usually made up its mind before the page even renders. This episode walks through how Cloudflare's anti-bot machinery actually works: the TLS handshake fingerprints (JA3, and how Chrome 110 broke it, and how JA4 fixed it), the HTTP/2 SETTINGS-frame fingerprint Akamai figured out in 2017, the 1-to-99 bot score, and the silent JavaScript battery of proof-of-work, proof-of-space, and web API probes that runs afterward. The throughline: the strongest signal isn't any…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.