evasion techniques

17 techniques

share on xlinkedin

the evasion-first lens. bot-detector intel reads the loader; the knowledge base reads the surface. this catalog reads the spoof: per surface, every technique that fakes it, which tools implement it, and the detector or coherence-check that catches it anyway. read the residual tell on each one - the spoof that holds on its own surface usually leaks on another.

  • canvas
  • webgl
  • audio
  • navigator + js surfaces
  • cdp / automation residue
  • tls / ja3 / ja4
  • http/2 transport
  • behavioral / kinematics

canvas noise / farbling

canvas · confirmed · as of 2026-06-15

surface
canvas
implementers
4
counters
4

how it works

perturb the pixel buffer returned by toDataURL / getImageData with a per-session, per-origin seeded noise so the canvas hash changes run-to-run and cannot be linked across sessions. brave ships this as farbling; stealth toolkits inject an equivalent hook over the 2d context.

implemented by

caught by

residual tell

the noise has a distribution: a canvas that reads slightly different on two reads of the SAME draw is itself the farbling tell. a real browser is pixel-stable; double-reading the canvas catches the dither.