The extra hop: counting a visitor's NAT layers from the outside

A NAT is a router that subtracts one from the TTL, so every NAT layer is a hop you can count. I built a small tool that reverse-traces a visitor back through the hole their own connection punched — and asked the honest question: is any of it useful for catching bots? Mostly no, sometimes cheaply yes.

July 15, 2026 · 10 min · Vitalii Zaiats

TCP-fingerprinting 300K residential proxy IPs: 98% are Linux

Probed 319,706 residential-proxy exits by their TCP SYN fingerprints — 98% Linux, two kernel defaults covering 70%+, MSS leaking the real link, and a handful of big ISPs — showing the “real user devices” are mostly a rack of Linux boxes.

March 26, 2026 · 4 min · Vitalii Zaiats