[/tools/bot-detectors/perimeterx-human]
← all providersvendor site ↗script2builtins ↗

human (perimeterx)

enterprise bot defense, originally perimeterx, rebranded as human security. loader is deployed per tenant under client.perimeterx.net. heavy on canvas, webgl, and behavioral collection.

  • perimeterx loader (walmart tenant)

    [ok]

    https://www.walmart.com/px/PXu6b0qd2S/init.js ↗

    last ran
    2026-05-19 22:32 utc
    (2d ago)
    last updated
    2026-05-15 04:51 utc
    (6d ago)
    size
    324.4kb
    sha256
    a6e46ad4a900
    apis touched
    440
    440 raw
    bot tells
    81
    sinks
    13
    0 leaked
    hazards
    24
    structural
    0
    anti-debug
    0
    L3/L4 hazards
    consistency
    0
    cross-checks
    providers
    0

    categories probed (19)

    click a row to drill into every api the script probes in that category.

    • [+] webgl18 apis · 4 tells · 38 hits
      • [+] *.getContexthigh · bot-tell×6
        details + source hits (6)
      • [+] *.getParameterhigh · bot-tell×2
        details + source hits (2)
      • [+] *.getExtensionhigh · bot-tell×1
        details + source hits (1)
      • [+] *.getSupportedExtensionshigh · bot-tell×1
        details + source hits (1)
      • [+] *.getExtensionmedium×4
        details + source hits (4)
      • [+] *.compileShadermedium×2
        details + source hits (2)
      • [+] *.shaderSourcemedium×2
        details + source hits (2)
      • [+] *.getShaderPrecisionFormatmedium×1
        details + source hits (1)
      • [+] *.createProgramlow×2
        details + source hits (2)
      • [+] *.createShaderlow×2
        details + source hits (2)
      • [+] *.linkProgramlow×2
        details + source hits (2)
      • [+] *.useProgramlow×2
        details + source hits (2)
      • [+] *.bindBufferinfo×3
        details + source hits (3)
      • [+] *.bufferDatainfo×2
        details + source hits (2)
      • [+] *.getAttribLocationinfo×2
        details + source hits (2)
      • [+] *.getUniformLocationinfo×2
        details + source hits (2)
      • [+] *.vertexAttribPointerinfo×1
        details + source hits (1)
      • [+] *.viewportinfo×1
        details + source hits (1)
    • [+] timing9 apis · 3 tells · 49 hits
      • [+] performance.nowmedium×7
        details + source hits (7)
      • [+] performance.memorymedium · bot-tell×4
        details + source hits (4)
      • [+] *.getTimezoneOffsetmedium · bot-tell×1
        details + source hits (1)
      • [+] Date.prototype.toStringmedium · bot-tell×1
        details + source hits (1)
      • [+] requestAnimationFramelow×3
        details + source hits (3)
      • [+] performance.getEntriesByTypelow×2
        details + source hits (2)
      • [+] Dateinfo×28
        details + source hits (28)
      • [+] Date.nowinfo×2
        details + source hits (2)
      • [+] *.getFullYearinfo×1
        details + source hits (1)
    • [+] audio4 apis · 3 tells · 5 hits
      • [+] *.getChannelDatahigh · bot-tell×2
        details + source hits (2)
      • [+] *.createDynamicsCompressorhigh · bot-tell×1
        details + source hits (1)
      • [+] *.startRenderinghigh · bot-tell×1
        details + source hits (1)
      • [+] *.createOscillatormedium×1
        details + source hits (1)
    • [+] headless-tells3 apis · 3 tells · 15 hits
      • [+] processhigh · bot-tell×8
        details + source hits (8)
      • [+] Bufferhigh · bot-tell×2
        details + source hits (2)
      • [+] globalmedium · bot-tell×5
        details + source hits (5)
    • [+] math8 apis · 2 tells · 24 hits
      • [+] Math.logmedium×9
        details + source hits (9)
      • [+] Math.expmedium×3
        details + source hits (3)
      • [+] Math.log1pmedium · bot-tell×3
        details + source hits (3)
      • [+] Math.asinhmedium×2
        details + source hits (2)
      • [+] Math.atanhmedium · bot-tell×2
        details + source hits (2)
      • [+] Math.acoshmedium×1
        details + source hits (1)
      • [+] Math.sinhmedium×1
        details + source hits (1)
      • [+] Math.sqrtlow×3
        details + source hits (3)
    • [+] workers5 apis · 2 tells · 12 hits
      • [+] OffscreenCanvashigh · bot-tell×1
        details + source hits (1)
      • [+] Workermedium · bot-tell×3
        details + source hits (3)
      • [+] *.registermedium×1
        details + source hits (1)
      • [+] Bloblow×5
        details + source hits (5)
      • [+] URL.createObjectURLlow×2
        details + source hits (2)
    • [+] document4 apis · 2 tells · 16 hits
      • [+] *.contentWindowhigh · bot-tell×5
        details + source hits (5)
      • [+] document.currentScriptmedium · bot-tell×7
        details + source hits (7)
      • [+] document.cookielow×3
        details + source hits (3)
      • [+] document.bodyinfo×1
        details + source hits (1)
    • [+] css3 apis · 2 tells · 8 hits
      • [+] *.getComputedStylehigh · bot-tell×4
        details + source hits (4)
      • [+] getComputedStylehigh · bot-tell×2
        details + source hits (2)
      • [+] *.matchesinfo×2
        details + source hits (2)
    • [+] introspection12 apis · 1 tells · 164 hits
      • [+] Object.definePropertymedium×14
        details + source hits (14)
      • [+] Object.getPrototypeOfmedium×10
        details + source hits (10)
      • [+] Object.getOwnPropertyDescriptormedium · bot-tell×9
        details + source hits (9)
      • [+] Object.getOwnPropertyDescriptorsmedium×4
        details + source hits (4)
      • [+] *.__proto__medium×3
        details + source hits (3)
      • [+] Object.getOwnPropertyNamesmedium×3
        details + source hits (3)
      • [+] Object.setPrototypeOfmedium×3
        details + source hits (3)
      • [+] Proxymedium×1
        details + source hits (1)
      • [+] *.hasOwnPropertylow×61
        details + source hits (61)
      • [+] *.toStringlow×36
        details + source hits (36)
      • [+] *.constructorlow×11
        details + source hits (11)
      • [+] Symbol.iteratorinfo×9
        details + source hits (9)
    • [+] screen6 apis · 1 tells · 7 hits
      • [+] screen.widthlow×2
        details + source hits (2)
      • [+] screen.availHeightlow×1
        details + source hits (1)
      • [+] screen.availWidthlow×1
        details + source hits (1)
      • [+] screen.colorDepthlow · bot-tell×1
        details + source hits (1)
      • [+] screen.heightlow×1
        details + source hits (1)
      • [+] screen.pixelDepthlow×1
        details + source hits (1)
    • [+] dom-layout6 apis · 1 tells · 16 hits
      • [+] *.getClientRectsmedium×3
        details + source hits (3)
      • [+] *.elementFromPointmedium · bot-tell×1
        details + source hits (1)
      • [+] *.getBoundingClientRectmedium×1
        details + source hits (1)
      • [+] *.observeinfo×5
        details + source hits (5)
      • [+] PerformanceObserverinfo×4
        details + source hits (4)
      • [+] MutationObserverinfo×2
        details + source hits (2)
    • [+] events5 apis · 1 tells · 30 hits
      • [+] *.movementXmedium · bot-tell×1
        details + source hits (1)
      • [+] *.movementYmedium×1
        details + source hits (1)
      • [+] *.dispatchEventlow×1
        details + source hits (1)
      • [+] *.timeStamplow×1
        details + source hits (1)
      • [+] *.addEventListenerinfo×26
        details + source hits (26)
    • [+] navigator4 apis · 1 tells · 5 hits
      • [+] *.userActivationhigh · bot-tell×1
        details + source hits (1)
      • [+] navigator.userAgentDatamedium×1
        details + source hits (1)
      • [+] navigator.userAgentlow×2
        details + source hits (2)
      • [+] navigator.platformlow×1
        details + source hits (1)
    • [+] canvas3 apis · 1 tells · 10 hits
      • [+] *.toDataURLhigh · bot-tell×2
        details + source hits (2)
      • [+] *.fillTextmedium×4
        details + source hits (4)
      • [+] *.fillinfo×4
        details + source hits (4)
    • [+] media2 apis · 1 tells · 5 hits
      • [+] Notification.permissionmedium · bot-tell×1
        details + source hits (1)
      • [+] crypto.getRandomValuesinfo×4
        details + source hits (4)
    • [+] speech1 apis · 1 tells · 3 hits
      • [+] *.getVoiceshigh · bot-tell×3
        details + source hits (3)
    • [+] storage3 apis · 0 tells · 22 hits
      • [+] *.keyslow×13
        details + source hits (13)
      • [+] localStoragelow×8
        details + source hits (8)
      • [+] *.estimatelow×1
        details + source hits (1)
    • [+] fonts1 apis · 0 tells · 1 hits
      • [+] FontFacemedium×1
        details + source hits (1)
    • [+] window1 apis · 0 tells · 10 hits
      • [+] location.hrefinfo×10
        details + source hits (10)

    bot-detection tells (29)

    strong indicators of bot-detection intent. drill into the categories section below to inspect description, evasion notes, and source snippets for any tell.

    • process ×8
    • *.getContext ×6
    • *.contentWindow ×5
    • *.getComputedStyle ×4
    • *.getVoices ×3
    • *.getChannelData ×2
    • *.toDataURL ×2
    • getComputedStyle ×2
    • Buffer ×2
    • *.getParameter ×2
    • *.createDynamicsCompressor ×1
    • *.startRendering ×1
    • *.userActivation ×1
    • *.getExtension ×1
    • *.getSupportedExtensions ×1
    • OffscreenCanvas ×1
    • Object.getOwnPropertyDescriptor ×9
    • document.currentScript ×7
    • global ×5
    • performance.memory ×4
    • Math.log1p ×3
    • Worker ×3
    • Math.atanh ×2
    • *.elementFromPoint ×1
    • *.movementX ×1
    • Notification.permission ×1
    • *.getTimezoneOffset ×1
    • Date.prototype.toString ×1
    • screen.colorDepth ×1

    network sinks (13)

    every place the script could ship data off the page. expand a row to see headers and the traced payload entries.

    • [+] xhrfc+sno leaks

      url source · fc+s

      location · L2:60258

      headers

      • Content-Type: text/plain;charset=UTF-8
      h.send()
    • [+] xhrGET fc+ano leaks

      url source · fc+a

      location · L2:62360

      c.send()
    • [+] navigationGET hj(eP.href,t,n)no leaks

      url source · hj(eP.href,t,n)

      location · L3:48552

      eP.href=hj(eP.href,t,n)
    • [+] xhr<dynamic>no leaks

      location · L3:51750

      r.send()
    • [+] workerGET (c=ak(<~F$VU'9f)~><&85dBPL-module/fromno leaks

      location · L3:70801

      new Worker(e)
    • [+] workerGET no leaks

      location · L3:71306

      new Worker(i)
    • [+] xhrGET (c=ak(<~F$VU'9f)~><&85dBPL-module/fromno leaks

      location · L4:6862

      i.send()
    • [+] xhrGET fc+ano leaks

      url source · fc+a

      location · L4:9908

      payload · shape string

      • <body>: literal 
      l
      c.send(l)
    • [+] xhrGET fc+ano leaks

      url source · fc+a

      location · L5:31266

      payload · shape string

      • <body>: r.yn
      r.yn
      c.send(r.yn)
    • [+] xhrGET document.location.hrefno leaks

      url source · document.location.href

      location · L5:88794

      t.send()
    • [+] image-srcGET https://b.px-cdn.net/api/v1no leaks

      location · L5:90356

      (new Image).src=ba
    • [+] fetchPOST no leaks

      location · L6:4870

      payload · shape string

      • <body>: literal 0
      o
      fetch(r,{method:"POST",mode:"no-cors",body:o,keepalive:!0})
    • [+] image-srcGET ('https://collector-a.px-cloud.net') + '/api/v2/collector/clientError?r=' + encodeURIComponent('{"appId":"' + (window._pxAppId || '') + '","tag":"eW5CaD8AUB99Zg==","name":"' + e.name + '","line":"' +…no leaks

      url source · ('https://collector-a.px-cloud.net') + '/api/v2/collector/clientError?r=' + encodeURIComponent('{"appId":"' + (window._pxAppId || '') + '","tag":"eW5CaD8AUB99Zg==","name":"' + e.name + '","line":"' +…

      location · L6:11399

      new Image().src = ('https://collector-a.px-cloud.net') + '/api/v2/collector/clientError?r=' + encodeURIComponent('{"appId":"' + (window._pxAppId || '') + '","tag":"eW5CaD8AUB99Zg==","name":"' + e.nam…

    dynamic-execution hazards (24)

    anywhere the script puts code beyond static reach. eval, function, document.write, dynamic import. these are the holes script2builtins-runtime would fill.

    • FunctionL2:23819

      `new Function` constructor compiles a string into a function. common eval-equivalent in fingerprinting blobs.

      new Function("return this")
    • with-statementL2:72478

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eP.h||eP)switch(eL+eN+eO){case eN- -202:return eM=!0,eI[eG[0]];case eP.j.n+233:default:case 138:if(MV=[-103,27,-22…
    • FunctionL2:81987

      `new Function` constructor compiles a string into a function. common eval-equivalent in fingerprinting blobs.

      new Function("return this")
    • setTimeout-stringL3:5181

      `setTimeout` called with a string argument is an eval-equivalent.

      setTimeout(e,50)
    • with-statementL3:14698

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eP.x||eP)switch(eL+eN+eO){case eN- -272:case 72:for(eP.y.A=-208,eG[2]=-(eL+-232),eG.b=0;eG.b<eG[eL+-232][eK(eL+-17…
    • with-statementL3:15841

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eX.J||eX)switch(eQ+eW+eP){case-94:return void(eR=!0);default:case eP-130:case-193:if(Ni=[-231,-205],eX.K.Q=Ni[0],e…
    • with-statementL3:17904

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eO.Z||eO)switch(eL+eN){default:case-56:case 114:clearInterval(qa),eG[-38]=(Nm={},Nm[eK(eL+685)]=pV,Nm),eG[0]("fgUF…
    • with-statementL3:37324

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eR.ap||eR)switch(eM+eO+eP+eQ){case eP- -321:return NL=[18,-6],eR.aq.ax=NL[0],eR.aq.ay=NL[1],void(eN=!0);case eM- -…
    • with-statementL3:44171

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eR.aI||eR)switch(eG+eN+eP+eQ){case 248:if(eR.aJ.aO=193,eM.length=eN+-180,eM[0]&&eM[eP+-91][eK(216)]){eR.aI=eR.aJ,e…
    • with-statementL3:45171

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eO.aW||eO)switch(eK+eN){default:case-21:return eM=!0,aZ.do||aZ.ob;case 4:Ob=[180,27],eO.aX.bb=Ob[0],eO.aX.bc=Ob[1]…
    • with-statementL3:46690

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eO.bk||eO)switch(eL+eN){case-164:case eL- -208:case 45:if(Of=[234,-237],eO.bl.bo=Of[0],eO.bl.bp=Of[1],eG[2]=vz[eK(…
    • evalL3:48237

      `eval` runs arbitrary source at runtime. content is invisible to static analysis.

      vx(eG[2])
    • with-statementL3:48007

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eP.by||eP)switch(eL+eN+eO){case eO- -50:eP.bz.bB=118,eG.length=3,eG[-25]={},eP.by=eP.bz,eN+=81,eO+=251;break;case …
    • with-statementL3:73570

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eO.bJ||eO)switch(eL+eN){case 306!=eN&&eN-150:eO.bK.bM=(kp(kf[hK])||"2,10").split(",")[eK(eL+897)]((function(e){ret…
    • with-statementL3:77062

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eP.ca||eP)switch(eL+eM+eN){default:eP.cb.cf=163,cb.cc=mR(),cb.cd=lp(),eP.ca=eP.cb,eL+=-193,eM+=122,eN+=-8;break;ca…
    • with-statementL3:85144

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eO.cp||eO){if(eG+eM+eN===eO.cq.cv+236)return eL=!0,cr;eO.cq.cv=-42,cq.cr=[];try{if(cq.cs=eP.ancestorOrigins,eP[eK(…
    • with-statementL3:86465

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eN.cD||eN){OA=[-194,6,125],eN.cE.cH=OA[0],eN.cE.cI=OA[1],eN.cE.cJ=OA[2],cE.cF=!1;try{cE.cG=new Audio,cE.cG&&eL(cE.…
    • with-statementL3:87105

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eN.cR||eN)switch(eG+eM){case 236!=eG&&52!=eG&&eG-14:eN.cS.cY=-112,eN.cR=eN.cW,eG+=366,eM+=-151;break;case-244:case…
    • with-statementL3:87965

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eP.di||eP)switch(eG+eM+eN+eO){case eM- -2:return void(eL=!0);case eP.dj.dn+55:return eP.dj.dl=mb[eK(eN+69)]-(eN+-1…
    • with-statementL4:10511

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eP.dx||eP)switch(eM+eO){default:case-219:eP.dy.dz=111,eG.length=2;try{if(eL(eG[1])===eY&&(Cg=eG[1]),eL(eG[0])===eY…
    • with-statementL4:11186

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eQ.dJ||eQ)switch(eL+eN+eO+eP){case eQ.dK.dP+-2:return OW=[125,216,181],eQ.dK.dP=OW[0],eQ.dK.dQ=OW[1],eQ.dK.dR=OW[2…
    • with-statementL4:14372

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eR.ea||eR)switch(eM+eP+eQ){case 69:case-56:Pf=[-120,-207],eR.eb.ee=Pf[0],eR.eb.ef=Pf[1],eL.length=eP+184,eL[27]=eN…
    • with-statementL4:16849

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eW.eo||eW)switch(eL+eQ+eR){case eQ-43:case-124:eW.ep.er=101,eG.length=1,eG.a=eG[eQ+-159].brands,eG[2]=eG[0][eK(eL+…
    • with-statementL4:18878

      `with` blocks dynamically scope identifier resolution; static analysis cannot follow accesses inside.

      with(eP.eA||eP)switch(eK+eN+eO){default:case eO-17:if(eP.eB.eE=92,Cj){eK+=228,eN+=68,eO+=19;break}eK+=84,eN+=-83,eO+=40…