Multi-layer fingerprinting from the TCP handshake to the canvas pixel — catch automation, anti-detect browsers, and rotating proxies, even when nothing else can.
Each card is a layer of the same fingerprint. Combine them and a spoofer needs to fool all five at once — across every request, on every page.
JA3, JA4, JA4_r and the in-house API Armor TLS signature. Spoofers can rewrite the user-agent, but cipher and extension ordering give them away on packet one.
Physical signals that are hard to spoof.
Patched main thread? Argus also reads from the Worker.
Fuzzy matching across all seven layers — recognise returning clients.
One header injected on every request. No extra round trip.
Three real attacker scenarios that pass through most stacks as “normal traffic.” The top of each card is the log line your server writes — the bottom is what Argus actually catches.
Same actor as 4,200 prior sessions. Identical TLS JA4, identical canvas hash, identical audio fingerprint across every rotated IP.
Main thread reports Chrome 142 / macOS. Worker scope still says HeadlessChrome. The patch covered window.navigator but missed self.navigator.
TLS extension order doesn't match real macOS Chrome. Audio context fingerprint is constant across 14 'different' users — the runtime patched canvas but forgot AudioContext.
Bytes in, fingerprints out, verdict in milliseconds.
16 03 01 02 00 01 00 01 fc 03 03 9e 88 d2 e1 f7 4a 09 1c 67 b2 c4 8e 5d 7a 31
t13d1516h2_8daaf6152771_b186095e22b61:65536;2:0;4:6291456;6:262144|15663105|0|m,a,s,pa4f7c3e2b9d18f4c7a2e6b1d8f3c9a5e891c4b7aillustrative — argus does not stream raw bytes to the client
v1.0 · <3ms p99Argus stores fingerprints with fuzzy matching across the full seven-layer signature, so you recognise returning clients across whatever they reset.
One eye loses them; the other six don't.
Most stacks watch one place. Argus watches every place at once.
| Capability | Browser-only fingerprinting | Network-only bot management | Argus all layers |
|---|---|---|---|
TLS / handshake fingerprint JA3, JA4, JA4_r | |||
HTTP/2 + HTTP/3 fingerprint Akamai signatures | |||
Browser canvas / WebGL / audio Hardware entropy | |||
Headless / anti-detect browser detection Worker-scope checks | |||
Cross-session fuzzy matching Across IPs and cookies | |||
One API for all layers Single visitor id |
One line in your <head> — Argus starts fingerprinting on the next request.
The five things every engineering team asks before they ship.
No credit card. Drop the SDK in five minutes; see your first verdict in fifty.
Built on the open JA3, JA4, and Akamai H2 fingerprint standards.