Nine layers.
One verdict.
Each dimension scores independently and folds into one weighted number. Any single critical tell ends it outright.
190+ WASM-collected signals — canvas, WebGL render hash, audio, fonts — cross-checked for impossibilities.
webdriver, headless markers, prototype tampering, eval hooks, Selenium / CDC leaks.
cipher, protocol, ALPN and HTTP version. curl, Python, Go each have a recognisable handshake.
CDP Runtime getter trap, Puppeteer / Playwright stack traces, worker-heartbeat debugger detection.
pointer entropy, straight-line detection, scroll cadence, keystroke variance.
SHA-256 hashcash gate + a per-session VM whose program rotates every challenge.
returning devices build trust; fingerprint reuse across IPs flags farms.
datacenter ranges, velocity, challenge-to-verify ratios.
invisible decoy routes and a decoy bundle no real client fetches.
Opaque on the wire.
The whole verify payload is a custom binary envelope — pure octets, PRNG-spaced markers. Wrong codec = rejected on arrival.