evasion techniques

17 techniques

the evasion-first lens. bot-detector intel reads the loader; the knowledge base reads the surface. this catalog reads the spoof: per surface, every technique that fakes it, which tools implement it, and the detector or coherence-check that catches it anyway. read the residual tell on each one - the spoof that holds on its own surface usually leaks on another.

canvas
webgl
audio
navigator + js surfaces
cdp / automation residue
tls / ja3 / ja4
http/2 transport
behavioral / kinematics

canvas noise / farbling

canvas · confirmed · as of 2026-06-15

surface: canvas
implementers: 4
counters: 4

how it works

perturb the pixel buffer returned by toDataURL / getImageData with a per-session, per-origin seeded noise so the canvas hash changes run-to-run and cannot be linked across sessions. brave ships this as farbling; stealth toolkits inject an equivalent hook over the 2d context.

implemented by

caught by

residual tell

the noise has a distribution: a canvas that reads slightly different on two reads of the SAME draw is itself the farbling tell. a real browser is pixel-stable; double-reading the canvas catches the dither.