Prosopo is a privacy-focused, self-hosted CAPTCHA alternative that provides multiple challenge types—image selection, puzzle (image jigsaw), proof-of-work, and frictionless (behavioral bot detection). The system comprises an Express-based provider API (with MongoDB and Redis for persistence and caching), a CLI for administrative tasks, client-side embeddable widgets (vanilla JS bundle, React/Angular/Vue/Svelte wrappers), and a suite of supporting libraries for cryptography, locale, datasets, and native Rust modules (JA4 TLS fingerprinting, Merkle tree acceleration, puzzle rendering). Bot detection is multi-layered: client-side behavioral data (mouse/keyboard/touch events, SIMD readings) is collected and server-side scored, combined with JA4 TLS fingerprint analysis, IP reputation (ipapi.is + MaxMind), DNS asymmetry detection, spam email heuristics, and custom decision machines per site key. The architecture is a monorepo with ~70 workspaces, leveraging Vite for bundling, Vitest for unit/integration tests, and Cypress for E2E visual regression testing. The provider enforces access policies (allow/block/restrict) via a Redis-backed rules engine and maintains usage counters for rate limiting. Asset sealing (AES-256-GCM) protects image CDN URLs, and puzzle difficulty is sampled with a CSPRNG-stratified ladder to frustrate solver calibration.
This repository provides a comprehensive Nginx security configuration package to block malicious bots, spam referrers, bad IPs, and vulnerability scanners. It includes curated blocklists (bad user agents, referrers, IPs, fake Googlebots), rate limiting/DDoS protection, and optional fail2ban integration. The core deliverable is a set of modular Nginx include files (bots.d/, conf.d/) and shell scripts (install-ngxblocker, setup-ngxblocker, update-ngxblocker) for automated deployment and daily updates. It also generates Google Analytics ghost spam exclusion lists and a Google Search Console disavow file. The architecture is a collection of configuration templates and deployment tooling, not a standalone application; it is designed to be included into existing Nginx server blocks. The repository is actively maintained with frequent updates to blocklists and CI testing across multiple Linux distributions.
Mosparo is a self-hosted, open-source spam protection system that replaces CAPTCHA on web forms. It is built as a monolithic Symfony 6.4 application (PHP 8.1+) with Doctrine ORM supporting MySQL, PostgreSQL, and SQLite. The system provides a multi-tenant architecture where each project (website) can define custom spam detection rules (field rules for words, emails, domains, IPs, user agents, etc. and submission rules like random value detection) and security measures (honeypot, minimum time, proof-of-work, request delaying, IP lockout, equal submission blocking). Integration is done via a frontend JavaScript widget that communicates with a verification API. The codebase also includes an administration panel for system settings, user management, GeoIP2 integration, rule package imports, statistics, and self-update capabilities. The architecture follows standard Symfony patterns with controllers, services (helpers), repositories, and Twig templates. The rule engine is extensible via interfaces and is reasonably well-tested at the unit level. The project is actively maintained with a robust CI/CD pipeline and Docker support.