Self-hosted browser fingerprinting, behavioral analysis, and fraud monitoring platform. One script tag gives you device fingerprints, bot detection, behavioral signals, threat intelligence enrichment, and a live dashboard.
- Browser fingerprinting — collects 35+ signal categories via FPScanner (screen, GPU, codecs, fonts, WebGL, automation flags, etc.)
- Bot detection — 21 built-in detection rules (WebDriver, CDP, Selenium, Playwright, spoofed GPU, impossible memory, etc.)
- Behavioral tracking — mouse movements, clicks, keystrokes, scrolls, copy/paste, navigation events via heartbeats every 30s
- Monitored domains — per-domain auth cookie detection, login-form authentication attempts, normalized session domains (docs)
- Risk scoring — automatic scoring from bot signals + customizable detection rules
- Custom dashboards — drag-and-drop widgets (stats, pie charts, histograms, weighted lists) with saved layouts
- Session filtering — 50+ filterable fields with autocomplete, composable filter conditions
- Threat intelligence — STIX 2.1 entity store with enrichment connectors (IPinfo, OpenCTI), relationship graph navigation
- Connector architecture — pluggable enrichment connectors via RabbitMQ, auto/manual trigger modes, health monitoring
cp .env.example .env # edit if needed
docker compose up --build| Service | URL |
|---|---|
| Dashboard | http://localhost:3000 |
| Demo page | http://localhost:3000/demo |
| API | http://localhost:5000 |
Add the fingerprint collection script to any page:
<script src="/ofm.js"></script>The script automatically:
- Collects a full device fingerprint on page load
- Sends behavioral heartbeats every 30 seconds
- Generates a deterministic device ID (
fsid) that persists across sessions
See Deployment for same-origin, reverse-proxied, and separate-host setups. Cookie-based authentication detection requires the script and collection API to be reachable through the monitored domain.
The dashboard supports customizable widgets with drag-and-drop layout. Use the filter builder to narrow results by any of 50+ fields.
Create stat counters, pie charts, histograms, or weighted lists — each with their own filter conditions:
| Step 1: Choose type | Step 2: Configure | Step 3: Result |
|---|---|---|
 |
 |
 |
A built-in demo page (/demo.html) lets you test fingerprint collection and see the raw signals in real time — no integration needed.
Browse and search STIX entities (IPs, user agents, AS numbers, malware, indicators). Click any entity to see its relationships, enrichment data, and linked session count. Navigate between related entities directly.
Monitor connector health, queue depths, and system logs in real time.
All variables are in .env.example. Key ones:
| Variable | Purpose |
|---|---|
OFM_SERVER_URL |
Client collection URL; empty for same-origin or reverse-proxied deployment |
DATABASE_URL |
PostgreSQL connection string |
REDIS_URL |
Redis connection string |
POSTGRES_PASSWORD |
Database password |
CONNECTOR_TOKEN |
Shared auth token for connector HTTP fallback |
INTEL_DECAY_DAYS |
Days before STIX intel is marked as decayed (default 7) |
- Architecture — system overview, data flow, STIX storage, folder structure
- Deployment — deployment modes, Caddy reverse proxying, and cookie-based collection requirements
- Monitored Domains — per-domain auth cookie, authentication-attempt detection, JSON import/export
- Connectors — how enrichment connectors work, how to build your own
- Rules — how to create and manage detection rules
- Filters — how filtering works, schema fields, code mapping
- Graph Explorer — interactive graph view: nodes, expansions, bulk expand, settings
Copyright (C) 2026 Quentin Fraty.
Licensed under the GNU Affero General Public License v3.0. You may use, modify, and redistribute this software, including commercially, provided derivative works remain under the AGPL-3.0 and you keep the copyright notices intact.
If you run a modified version as a network service, section 13 requires you to offer its complete source code to your users.
Third-party attributions, including the MIT-licensed fpscanner component, are listed in NOTICE.