frontguard probe

/sitemap.xml · GET · served by probe-backend on 127.0.0.1:18081

JA4 family fingerprints (X-Fg-*)

X-Fg-Sni	probe.blksails.cn
X-Fg-Ja4	t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3
X-Fg-Ja4s	t130200_1301_a56c5b993250
X-Fg-Ja4h	ge20cn030000_859c524ed96e_f3c642ca530a_2df686a4353c
X-Fg-Ja4t	62727_2-4-8-1-3_1460_7
X-Fg-Ja4ts	— not set —
X-Fg-Os-Probe	Windows
X-Fg-Os-Scores	Windows=55
X-Fg-Verdict	— not set —
X-Fg-Verdict-Version	1
X-Fg-Session-Id	lUT8y-RTrdtL5XsI

Request context

Host	probe.blksails.cn
User-Agent	Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
X-Forwarded-For	216.73.217.17
X-Forwarded-Proto	— not set —
Accept	/
Accept-Language	— not set —
Accept-Encoding	gzip, br, zstd, deflate

Browser fingerprint (WeChat Pay SDK fingerprint2.js)

Fingerprint	— loading SDK from wx.gtimg.com … —
Computed in	—
SDK URL	`https://wx.gtimg.com/wxpay_h5/fingerprint2.min.1.5.1.js`

Pure-client-side SHA-style hash over UA, screen, timezone, fonts, canvas, WebGL, plugins, etc. (FingerprintJS-derived; bundled by WeChat Pay for v2 payment risk control). Differs from server-side X-Fg-* — those reflect TCP/TLS/HTTP layers visible to frontguard; this one reflects browser-only attributes only the JS runtime can see.

WebRTC leak / VPN consistency

Server-seen Remote IP (filled by /fg-myip)
IPv4 Address	—
IPv6 Address	—
WebRTC Support
RTCPeerConnection	— checking … —
RTCDataChannel	— checking … —
WebRTC Leak Test
Local IP Leak	— probing (≤5s) … —
Remote IP Match	— probing (≤5s) … —
WebRTC IPs
Local IP Address	—
Public IPv4 Address	—
Public IPv6 Address	—
Raw ICE candidates	—

Powered by /probe.js (bundled WebRTC + fingerprint2 drop-in; the WebRTC half is also served standalone at /fg-webrtc.js). Fetches /fg-myip to learn the server-seen Remote IP, then enumerates ICE candidates via public STUN (Cloudflare + Tencent QQ). Local IP Leak = any RFC1918 / link-local address exposed (mDNS .local hashes are the protective default — NOT a leak). Remote IP Match = STUN-reflected public IP vs the IP the server actually saw on the wire; mismatch means the VPN/proxy is split-routing UDP and exposing the user's real ISP IP. Both halves report to /_fg/report for server-side correlation against the access log.

Raw request headers (19)

Accept: */*
Accept-Encoding: gzip, br, zstd, deflate
Cookie: _fg_vid=Ehpgyt5bE0yQRwovLW_3lw
Host: probe.blksails.cn
User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
X-Fg-Action: allow
X-Fg-Ja4: t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3
X-Fg-Ja4h: ge20cn030000_859c524ed96e_f3c642ca530a_2df686a4353c
X-Fg-Ja4s: t130200_1301_a56c5b993250
X-Fg-Ja4t: 62727_2-4-8-1-3_1460_7
X-Fg-Matched-Rules: ua_no_accept_lang
X-Fg-Os-Probe: Windows
X-Fg-Os-Scores: Windows=55
X-Fg-Remote-Addr: 216.73.217.17
X-Fg-Score: 15
X-Fg-Session-Id: lUT8y-RTrdtL5XsI
X-Fg-Sni: probe.blksails.cn
X-Fg-Verdict-Version: 1
X-Forwarded-For: 216.73.217.17

Raw JSON

{
  "method": "GET",
  "path": "/sitemap.xml",
  "headers": {
    "Host": "probe.blksails.cn",
    "User-Agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
    "Accept": "*/*",
    "Accept-Encoding": "gzip, br, zstd, deflate",
    "Cookie": "_fg_vid=Ehpgyt5bE0yQRwovLW_3lw",
    "X-Fg-Action": "allow",
    "X-Fg-Ja4": "t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3",
    "X-Fg-Ja4h": "ge20cn030000_859c524ed96e_f3c642ca530a_2df686a4353c",
    "X-Fg-Ja4s": "t130200_1301_a56c5b993250",
    "X-Fg-Ja4t": "62727_2-4-8-1-3_1460_7",
    "X-Fg-Matched-Rules": "ua_no_accept_lang",
    "X-Fg-Os-Probe": "Windows",
    "X-Fg-Os-Scores": "Windows=55",
    "X-Fg-Remote-Addr": "216.73.217.17",
    "X-Fg-Score": "15",
    "X-Fg-Session-Id": "lUT8y-RTrdtL5XsI",
    "X-Fg-Sni": "probe.blksails.cn",
    "X-Fg-Verdict-Version": "1",
    "X-Forwarded-For": "216.73.217.17"
  }
}

If JA4 / JA4S / JA4H / JA4T / OS-Probe rows are empty, the request did not pass through frontguard, or the server-side capturer could not observe the SYN packet for this connection. JA4T requires the kernel-level capturer to attach to the NIC the public traffic arrives on (loopback hairpins produce empty results).