Bluekit PhaaS WebRTC STUN fingerprint check and fake CAPTCHA bot evasion

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

This rule detects potential browser fingerprinting activity or unauthorized WebRTC STUN requests, often associated with malicious landing pages, phishing, or automated detection evasion. It identifies the presence of specific browser API calls (RTCPeerConnection, navigator.deviceMemory, navigator.hardwareConcurrency) or suspicious use of STUN server ports (3478, 19302) on non-authorized domains.