01
Fingerprint
190+ WASM-collected signals — canvas, WebGL render hash, audio, fonts — cross-checked for impossibilities.
Detection
Seven layers.
Seven layers.
One verdict.
Each dimension scores independently and folds into one weighted number. Any single critical tell ends it outright.
02
Environment
webdriver, headless markers, prototype tampering, eval hooks, Selenium / CDC leaks.
03
TLS / HTTP
cipher, protocol, ALPN and HTTP version. curl, Python, Go each have a recognisable handshake.
04
Automation
CDP Runtime getter trap, Puppeteer / Playwright stack traces, worker-heartbeat debugger detection.
05
Behaviour
pointer entropy, straight-line detection, scroll cadence, keystroke variance.
06
Proof-of-work
SHA-256 hashcash gate + a per-session VM whose program rotates every challenge.
07
Device history
returning devices build trust; fingerprint reuse across IPs flags farms.
Outside the weighted score. Two more families never get a weight because they
never need one — a single hit ends the session on its own: honeypots (invisible decoy routes and
a decoy bundle no real client fetches) and IP / ASN reputation (datacenter ranges, velocity,
challenge-to-verify ratios).
The wire
Opaque on the wire.
The whole verify payload is a custom binary envelope — pure octets, PRNG-spaced markers. Wrong codec = rejected on arrival.