bot-detector intel

cloudflare's captcha-less proof-of-work + behavioral challenge. one of the most-deployed bot defenses on the public web. the loader script is small and orchestrates the underlying widget code.

tells

31

sinks

4

leaks

0

scripts

1

categories · anti-debug · document · dom-layout · events · introspection · navigator · storage · timing · window

visual + behavioral challenge from intuition machines. ships a loader that boots the widget and gathers a behavioral profile during solve.

tells

42

sinks

3

leaks

0

scripts

1

categories · audio · canvas · css · document · dom-layout · events · fonts · headless-tells · introspection · math · media · navigator · screen · storage · timing · wasm · window

google's recaptcha loader. v2 ships the i'm-not-a-robot widget, v3 runs entirely in the background and scores every page view. same api.js entry, divergent behaviors.

tells

22

sinks

6

leaks

0

scripts

2

categories · canvas · css · document · dom-layout · events · fonts · headless-tells · introspection · math · media · navigator · screen · storage · timing · window · workers

google's enterprise tier. same general shape as v3 with extra risk-signal endpoints and a different bootstrap.

tells

22

sinks

6

leaks

0

scripts

2

categories · canvas · css · document · dom-layout · events · fonts · headless-tells · introspection · math · media · navigator · screen · storage · timing · window · workers

identity-proofing + game-style challenges from arkose (formerly funcaptcha). loader pulls a public-key-scoped bundle and orchestrates the puzzle.

tells

17

sinks

1

leaks

0

scripts

1

categories · css · document · events · introspection · media · screen · storage · timing

edge bot-detection vendor. their tags.js orchestrates fingerprint collection + challenge fallbacks. the canonical cdn host is js.datadome.co. per-tenant deployments live behind a site's own subdomain.

tells

9

sinks

3

leaks

0

scripts

1

categories · anti-debug · document · dom-layout · events · fonts · introspection · math · navigator · storage · timing · webrtc · window · workers

abraham juliot's open-source fingerprinting probe. not a detection vendor itself, included as the canonical reference for what the surface area actually looks like end-to-end. the catalog inside script2builtins is calibrated against this script.

tells

178

sinks

3

leaks

0

scripts

1

categories · audio · canvas · css · document · dom-layout · events · fonts · intl · introspection · media · media-capabilities · navigator · screen · speech · storage · svg · timing · webgl · webrtc · window · workers

enterprise bot defense, originally perimeterx, rebranded as human security. loader is deployed per tenant under client.perimeterx.net. heavy on canvas, webgl, and behavioral collection.

tells

81

sinks

13

leaks

0

scripts

1

categories · audio · canvas · css · document · dom-layout · events · fonts · headless-tells · introspection · math · media · navigator · screen · speech · storage · timing · webgl · window · workers

imperva bot defense (formerly incapsula). loader is shipped from each protected origin under /_Incapsula_Resource?SWJIYLWA=..., not a public cdn. heavy emphasis on tls/http fingerprinting upstream of the js layer.

tells

19

sinks

0

leaks

0

scripts

1

categories · events · headless-tells · introspection · wasm

akamai bot manager. loader served per-tenant from akamai edges; orchestrates sensor data collection and a challenge ladder. the script is heavily obfuscated and shipped alongside cookie-tied tokens (_abck and friends).

tells

2

sinks

1

leaks

0

scripts

1

categories · events · introspection · storage · timing · window

kasada bot defense. loader ships as ips.js / 148c.js under the protected origin. very dynamic-execution heavy. mostly inscrutable via static analysis alone, which is itself an interesting tell.

tells

0

sinks

0

leaks

0

scripts

1

categories · introspection · math · storage · timing

f5 shape (formerly shape security, sometimes called shape defense). loader is site-deployed and rotates frequently. one of the more aggressive obfuscation profiles in the market.

tells

1

sinks

0

leaks

0

scripts

1

categories · anti-debug · events · introspection · storage · timing · workers