Traffic enters here.Origin stays private.
NetSpectra sits between your visitor and your application — at the edge, before HTTP reaches your code. The rest of this page shows where we stand, what we read, what your users feel, and what knobs stay in your hands.
Three protocol streams. One verdict per request.
Three kinds of traffic hit your edge: a real browser, a headless cluster, and a crafted client. NetSpectra reads what each one is already saying — TLS fingerprint, header order, protocol-side signals — and decides in microseconds. One passes. Two get dropped. No CAPTCHAs, no cookies, no JavaScript.
What your users actually see.
The page just loads
- No CAPTCHA, no challenge, no extra round-trip
- No JavaScript or SDK forced onto the page
- Your application returns the real response
Stopped at the edge
- Blocked before HTTP reaches your app
- Your origin IP never appears in DNS or logs
- Optionally returned a stub response — your call, per site
What we read before your app sees a byte.
Network signature
Every operating system writes its packets slightly differently. TTL, TCP window size, segment size — the kernel-level details that user-space code cannot fake. We read them from the first SYN packet, before TLS even starts.
- Initial TTL
- TCP window size
- MSS / TCP options order
Encryption signature
Every browser builds its TLS handshake in its own order — the set of ciphers, the order of extensions, the way it signals supported groups. That ordering is the JA4 fingerprint. Two visitors with the same User-Agent will have identical JA4 if they really are the same browser.
- JA4 / JA3 fingerprint
- Cipher suite order
- TLS extensions, ALPN
Application signature
HTTP/2 lets clients announce settings frames and choose pseudo-header order. Real Chrome, Firefox, Safari all do this differently. Headless and scripted clients leave noticeable patterns that no UA-string spoofing can hide.
- HTTP/2 SETTINGS frame
- Pseudo-header ordering
- Real header order
What you actually control.
How strict per site
Set the line between «let through» and «block» for each domain. Lenient for marketing pages, strict for checkout or sign-in. Changes apply within seconds — no redeploy, no code change.
Watch the edge live
See every connection, every verdict, every fingerprint — in real time. Drill into a single session, export a per-connection forensic report, mark a connection as verified if you disagree with the edge.
Wire signals into your stack
Pull verdicts and fingerprints over HTTPS. Stream them into your fraud pipeline, your analytics warehouse, or your own dashboards. Webhooks for real-time, REST for batch.