bot-detector intel
12 providers · refreshed dailyevery fingerprint surface these loaders probe is catalogued in the fingerprint knowledge base: severity, whether the access is itself a tell, and how it's spoofed.
- last ran
- 2026-06-29 19:22 utc
- (6d ago)
- last updated
- 2026-06-29 19:22 utc
- (6d ago)
- script changes (7d)
- 8
- providers tracked
- 12
detection-signal matrix
every tracked vendor loader × the signals the daily static analysis extracts. cells are the real counts, shaded by magnitude (hotter = more aggressive probing). click a cell to break it down, a vendor to open its full loader analysis, or a header to sort.
- hot top third
- warm mid
- cool low
- · none
| creepjs (reference impl) | 1 | |||
| human (perimeterx) | 1 | |||
| hcaptcha | 1 | |||
| cloudflare turnstile | 1 | |||
| recaptcha v2 / v3 | 2 | |||
| recaptcha enterprise | 2 | |||
| imperva (incapsula) | 1 | |||
| arkose labs (funcaptcha) | 1 | |||
| datadome | 1 | |||
| akamai bot manager | 1 | |||
| f5 shape | 1 |
headers sort · click a cell for the breakdown · vendor name opens the full loader analysis
providers
cloudflare turnstile
[ok]cloudflare's captcha-less proof-of-work + behavioral challenge. one of the most-deployed bot defenses on the public web. the loader script is small and orchestrates the underlying widget code.
- tells
- 34
- sinks
- 4
- leaks
- 0
- scripts
- 1
fetched 6d ago1 changed (7d)categories · anti-debug · document · dom-layout · events · introspection · navigator · storage · timing · window
hcaptcha
[ok]visual + behavioral challenge from intuition machines. ships a loader that boots the widget and gathers a behavioral profile during solve.
- tells
- 83
- sinks
- 4
- leaks
- 0
- scripts
- 1
fetched 6d ago1 changed (7d)categories · anti-debug · audio · canvas · css · document · dom-layout · events · fonts · headless-tells · introspection · math · media · navigator · screen · storage · timing · wasm · webrtc · window
recaptcha v2 / v3
[ok]google's recaptcha loader. v2 ships the i'm-not-a-robot widget, v3 runs entirely in the background and scores every page view. same api.js entry, divergent behaviors.
- tells
- 22
- sinks
- 6
- leaks
- 0
- scripts
- 2
fetched 6d ago1 changed (7d)categories · canvas · css · document · dom-layout · events · fonts · headless-tells · introspection · math · media · navigator · screen · storage · timing · window · workers
recaptcha enterprise
[ok]google's enterprise tier. same general shape as v3 with extra risk-signal endpoints and a different bootstrap.
- tells
- 22
- sinks
- 6
- leaks
- 0
- scripts
- 2
fetched 6d ago1 changed (7d)categories · canvas · css · document · dom-layout · events · fonts · headless-tells · introspection · math · media · navigator · screen · storage · timing · window · workers
arkose labs (funcaptcha)
[ok]identity-proofing + game-style challenges from arkose (formerly funcaptcha). loader pulls a public-key-scoped bundle and orchestrates the puzzle.
- tells
- 17
- sinks
- 1
- leaks
- 0
- scripts
- 1
fetched 6d agolast delta 1mo agocategories · css · document · events · introspection · media · screen · storage · timing
datadome
[ok]edge bot-detection vendor. their tags.js orchestrates fingerprint collection + challenge fallbacks. the canonical cdn host is js.datadome.co. per-tenant deployments live behind a site's own subdomain.
- tells
- 9
- sinks
- 3
- leaks
- 0
- scripts
- 1
fetched 6d agolast delta 27d agocategories · anti-debug · document · dom-layout · events · fonts · introspection · math · navigator · storage · timing · webrtc · window · workers
creepjs (reference impl)
[ok]abraham juliot's open-source fingerprinting probe. not a detection vendor itself, included as the canonical reference for what the surface area actually looks like end-to-end. the catalog inside script2builtins is calibrated against this script.
- tells
- 226
- sinks
- 3
- leaks
- 0
- scripts
- 1
- consistency ×5
fetched 6d agolast delta 23d agocategories · anti-debug · audio · canvas · css · document · dom-layout · events · extensions · fonts · intl · introspection · media · media-capabilities · navigator · screen · speech · storage · svg · timing · webgl · webrtc · window · workers
human (perimeterx)
[ok]enterprise bot defense, originally perimeterx, rebranded as human security. loader is deployed per tenant under client.perimeterx.net. heavy on canvas, webgl, and behavioral collection.
- tells
- 111
- sinks
- 13
- leaks
- 0
- scripts
- 1
- consistency ×1
infra · PerimeterX / HUMAN
fetched 6d ago1 changed (7d)categories · anti-debug · audio · canvas · css · document · dom-layout · events · fonts · headless-tells · introspection · math · media · navigator · screen · speech · storage · timing · webgl · webrtc · window · workers
imperva (incapsula)
[ok]imperva bot defense (formerly incapsula). loader is shipped from each protected origin under /_Incapsula_Resource?SWJIYLWA=..., not a public cdn. heavy emphasis on tls/http fingerprinting upstream of the js layer.
- tells
- 19
- sinks
- 0
- leaks
- 0
- scripts
- 1
fetched 6d ago1 changed (7d)categories · events · headless-tells · introspection · wasm
akamai bot manager
[ok]akamai bot manager. loader served per-tenant from akamai edges; orchestrates sensor data collection and a challenge ladder. the script is heavily obfuscated and shipped alongside cookie-tied tokens (_abck and friends).
- tells
- 2
- sinks
- 1
- leaks
- 0
- scripts
- 1
fetched 6d agolast delta 1mo agocategories · events · introspection · storage · timing · window
kasada
[ok]kasada bot defense. loader ships as ips.js / 148c.js under the protected origin. very dynamic-execution heavy. mostly inscrutable via static analysis alone, which is itself an interesting tell.
- tells
- 0
- sinks
- 0
- leaks
- 0
- scripts
- 1
fetched 6d ago1 changed (7d)categories · introspection · math · storage · timing
f5 shape
[ok]f5 shape (formerly shape security, sometimes called shape defense). loader is site-deployed and rotates frequently. one of the more aggressive obfuscation profiles in the market.
- tells
- 1
- sinks
- 0
- leaks
- 0
- scripts
- 1
fetched 6d ago1 changed (7d)categories · anti-debug · events · introspection · storage · timing · workers
related instruments
- stealth benchmark
see how real automation tools fare against these same detectors, inferred tells against live verdicts.
- cookie monster
the return-trip contract per provider: the cookie or token its loader plants and expects back.
- fingerprint knowledge base
look up any surface a detector probes: severity, whether the access is itself a tell, and how it is spoofed.