AI
The Problem with IP and User-Agent Blocking
IP addresses rotate at scale. Attackers can cycle through 100 different IPs per minute, and user-agent strings are trivially changed. Traditional WAFs and honeypot setups give you source country, top ports, and top requests. That is not enough to connect activity across infrastructure. Fingerprints go deeper: TLS client hellos, HTTP header order, and HTTP/2 frame sequences are tied to the underlying library, not the attacker’s choice of IP or user-agent string. Changing them requires actual effort.
Finch: A Fingerprint-Aware Reverse Proxy
Finch is a Go reverse proxy that collects JA3, JA4, JA4-H, and HTTP header fingerprints and exposes them to HCL rules. Those rules trigger five actions: allow, deny, route, tarpit, and deceive. The tarpit slows scanners down. An nmap scan that normally completes in 20 seconds takes more than 10 minutes, limited to 16 simultaneous proxy connections. Configuration is Terraform-style HCL. A built-in Suricata HTTP parser lets you match community rules and route flagged traffic straight to a honeypot.
How TLS, HTTP, and HTTP/2 Fingerprinting Works
TLS fingerprinting looks at the client hello: version, cipher suites, and extensions. JA3 hashes those parameters into an MD5 string. JA4 improves on JA3 by sorting the cipher list before hashing, making it resilient to Chrome’s GREASE extension, which randomizes extension order. For HTTP, the order of request headers is a strong signal. Python’s requests library always sends the same three headers in the same sequence. HTTP/2 adds settings, window-update, and priority frames, which combine with TLS to produce a more reliable cross-layer fingerprint.
JA3 Rotation and Threat Actor Attribution
The pattern Karimi found while preparing his HoneyConf talk: one IP generating hundreds of unique JA3 fingerprints rather than the expected many IPs with one fingerprint. Each request dropped a different cipher from the list, cycling through variations to avoid fingerprint-based detection. That behavior actually made the actor more visible. Four source IPs from completely different ASNs turned out to share two or three JA3 fingerprints by mistake, and those common fingerprints linked the clusters together into a single actor.
Dynamic Deception with LLM-Generated Responses
The deceive action calls Galah, Karimi’s LLM-based honeypot from the previous year, which generates HTTP responses on the fly. Finch passes the incoming request to Galah, waits for the LLM, and returns the result. Responses arrive in under a second. Caching stores the first generated reply per path, avoiding repeat LLM calls. To demonstrate, Karimi planted a fake API key with a fake OpenAI endpoint in Pastebin. Within minutes, a bot hit the Finch proxy with that key and received a Markov-chain junk response at zero LLM cost.
AI Agent for Autonomous Rule Updates
Finch exposes an admin API so rules can be updated programmatically. An experimental agent monitors the proxy’s log stream, runs Python analysis via a code interpreter tool, and pushes block rules when it detects anomalous patterns. To test it, Karimi fed the same 10-megabyte HoneyTLS log from seven years prior to the agent. It found the JA3 rotation pattern in roughly one minute, running 40 to 50 pandas queries without additional instructions. The key design choice: give the LLM a code interpreter, not raw context. Without it, it fabricates analysis.
Notable Quotes
IPs and user agents can easily be faked Adel Karimi · ▶ 6:08
“Oh, these four things stand out.” Adel Karimi · ▶ 28:55
analyze it. just lies to you like even if it says like yeah I did it it didn’t do anything. Adel Karimi · ▶ 40:03
Key Takeaways
- IP and user-agent blocking is easily evaded; TLS and HTTP header fingerprints require real library changes to fake.
- Finch’s tarpit slows an nmap scan from 20 seconds to over 10 minutes with no application changes.
- JA3 rotation, intended to hide tool identity, creates a distinctive fingerprint pattern that links threat actors across ASNs.
- Coupling a code interpreter with an LLM lets an agent analyze 10-megabyte logs in one minute instead of hours.
- Finch’s admin API enables an autonomous agent to detect anomalous fingerprint clusters and push block rules in real time.
About the Speaker(s)
Adel Karimi is a security engineer at OpenAI specializing in detection and response. Outside work, he builds open-source tools for threat detection, honeypots, and network fingerprinting, including Finch, Galah, and Venator. He also photographs night skies in remote locations worldwide.