Device fingerprint
The set of attributes a browser or device reveals in ordinary use, combined into an identifier: fonts, screen dimensions, time zone, language, graphics behaviour, extensions. Used by defenders to recognise a returning device, and sold underground as something to wear.
Why it matters to you
A fingerprint is a claim the client makes about itself, so it is evidence and never proof. Treating a matching fingerprint as authentication inverts the control: it is useful for spotting a device that should not be here, and worthless for confirming one that should.
Where we meet it
Fingerprints are sold alongside the credentials taken from the same machine, as a matched set. The buyer is not trying to look like any real user; they are trying to look like the specific one whose session they hold.
Connected terms
Antidetect browser
A browser built to present a consistent, disposable fingerprint per profile: its own canvas, fonts, timezone and proxy. Sold so a stolen session can be replayed from a machine that looks like the victim's.
Bot shop
A marketplace that sells the output of one infected machine as a single unit: its cookies, saved passwords, browser fingerprint and time zone, packaged so a buyer can load the lot into an antidetect browser and resume the victim's sessions.
Session cookie
The token that proves a browser is already logged in, copied straight out of a victim's browser by an infostealer. Replayed elsewhere it opens the account without the password and without a second factor.
Where this term stops being vocabulary
Sherlog is where you watch it happen to you
Knowing the word is the cheap half. The platform is the half where the term arrives attached to your domain, with a timestamp and the source it came from.
More from the infrastructure
Antidetect browser
A browser built to present a consistent, disposable fingerprint per profile: its own canvas, fonts, timezone and proxy. Sold so a stolen session can be replayed from a machine that looks like the victim's.
Bulletproof hosting
Hosting sold on the promise that abuse complaints go unanswered and legal requests go unread. Priced well above ordinary hosting, because that indifference is the entire product.
C2 panel
The web console an operator uses to run infected machines: victims listed, tasks queued, output collected. Sold with the malware, screenshotted in the advertisement, and often the most revealing artifact a crew produces.
Crypto mixer
A service that pools cryptocurrency from many senders and pays out from the pool, so that the link between an incoming and an outgoing transaction is broken. Charged as a percentage, sometimes with a delay bought separately.