Antibot-Detector is a free Chrome extension from Scrapfly that profiles a page's anti-bot systems, CAPTCHAs and fingerprinting techniques, useful for authorized assessment and defensive research.
| Tool | scrapfly/Antibot-Detector — Chrome extension that identifies anti-bot systems, CAPTCHAs and fingerprinting techniques on any page you visit |
| Category | Passive web reconnaissance / browser extension (JavaScript) |
| Primary Use | Profiling which protections (Cloudflare, DataDome, Akamai, reCAPTCHA, etc.) guard a page, with confidence scores, before starting authorized scraping or security research work |
| Safe Use | Educational and documentary analysis for authorized professionals: external review of your own site's bot defenses, authorized assessments, and web security research in lab environments |
| Telemetry Note | Purely passive observation of what the page already exposes (URLs, cookies, headers, DOM, JS calls); uploads to share links carry no cookie or header values, and statistics are computed locally |
scrapfly/Antibot-Detector answers the first question every scraping and security-research engagement runs into: what is actually protecting this page? Rather than forcing you to manually hunt through DevTools for telltale script hosts, cookies and challenge endpoints, the extension watches pages as you browse normally and reports which anti-bot products, CAPTCHA widgets and browser-fingerprinting techniques are in play — each with a confidence score and a difficulty rating. It ships from the Chrome Web Store, but the repository itself is the source of truth: every detector is a plain JSON file you can read, edit or extend, which makes it a genuinely auditable piece of tooling rather than an opaque black box.
The coverage numbers are the headline feature: 81 technologies out of the box, split into 39 anti-bot systems, 21 CAPTCHAs and 21 fingerprinting techniques. The anti-bot list reads like a vendor catalog — Akamai Bot Manager, DataDome, Cloudflare Bot Management, Kasada, HUMAN (PerimeterX), Imperva Incapsula, Shape Security, ThreatMetrix, plus Chinese-market products like Aliyun, Yundun and Ruishu that Western tools often miss. The CAPTCHA roster spans reCAPTCHA, hCaptcha, Cloudflare Turnstile, Arkose Labs FunCaptcha, GeeTest and Yandex SmartCaptcha, among others. From a defensive standpoint, that breadth is itself useful intelligence: it is a curated map of what the commercial bot-defense ecosystem actually looks like.
The detection engine is the interesting part architecturally. Each detector combines up to eight methods: URL matching against page addresses, script sources and network requests; Cookies, including HttpOnly ones; Headers such as x-kpsdk-ct; Content scanning of the HTML and inline/loaded script code; DOM matching via CSS selectors; Window properties like grecaptcha.render; JavaScript hooks on fingerprinting-prone APIs; and Payload inspection of POST/PUT/PATCH bodies. The README gives concrete examples throughout — _abck for Akamai, datadome cookies, challenges.cloudflare.com/turnstile/v0/api.js, sensor_data payloads — which makes the rule format easy to internalize by example.
Scoring is layered rather than binary. A signal that merely mentions a vendor's name scores 5–10%; a signal only that vendor produces — its own script host, its own cookie, its challenge endpoint — is treated as proof and scores 100% alone, as does a complete integration of script plus cookie, widget frame or challenge request. Shared or generic signals land between 15% and 90%. The displayed score per detector is its strongest single rule or combination, and the page-level difficulty rating (Low, Medium, High) colors the toolbar badge. This is a sensible epistemology: it separates "probably" from "definitely," which matters when you are documenting findings rather than guessing.
The fingerprinting detection deserves a note because of how it is implemented. API hooks — HTMLCanvasElement.prototype.toDataURL is the README's example — are installed before the page's own scripts run, and they cover same-origin iframes where fingerprinting code commonly hides. The hooks watch for at least 4 seconds, until the page has been quiet for 2 seconds, and at most 8 seconds. That covers the 21 fingerprinting technique categories, from Canvas and WebGL to Audio, Font, WebRTC, Battery API and Gamepads. For defenders, this is effectively a free client-side fingerprinting audit: load your own site and see exactly which browser APIs your third-party scripts are touching.
The popup itself is well thought out. The Detection tab lists each protection with its confidence, difficulty and matching methods, and clicking a card reveals the exact signals behind it. A Copy menu produces a Markdown table for tickets or JSON for tooling — explicitly without cookie or header values, a thoughtful hygiene decision. History tracks every page that produced detections, supports search, pinning, notes, and export as JSON, CSV, plain text or Markdown, and flags pages whose protections changed since the last scan with a Changed badge. A local statistics page aggregates activity, protections, domains, confidence, signals and rule performance from your own history — nothing is phoned home.
The Rules tab is where the tool earns its keep for serious users. Every built-in detector can be toggled, edited or cloned, and new ones can be added with per-pattern configuration: where to look (page, scripts, or all requests; request or response side for cookies and headers), whether the pattern is a regex, whole-word or case-sensitive, and its individual confidence weight. Two testing conveniences stand out: Check against History shows how many of your saved pages a pattern matches, and Test on this page runs an unsaved edit live, showing what each cookie, URL, content and DOM pattern actually finds — while honestly listing header, JS-hook, window and payload patterns as requiring a real scan rather than reporting false negatives. Detectors import and export as JSON, and the Update action pulls official rules from the repository's latest release without clobbering your local edits without asking.
Installation is deliberately frictionless because there is no build step at all. Beyond the Chrome Web Store, you can grab a release zip and load it unpacked via chrome://extensions in Developer mode, or simply git clone https://github.com/scrapfly/Antibot-Detector.git and load the folder as-is — after editing a file, the extension's reload button plus a page refresh picks up changes. That no-build design reinforces the auditability story: what you load is literally what you read.
Operationally, the tool is passive by construction. It observes what the page already exposes — request metadata the browser sees anyway, DOM state, API calls the page itself makes — and does not attempt to solve, bypass or interact with any challenge. Its caching behavior is worth knowing: results are reused for 7 days by default, with configurable scope (whole domain, same path, or exact URL), and Clear Cache forces a rescan on next load. Sharing a detection produces a link via dpaste.com by default, so treat that as external transmission when working on sensitive engagements, and use the Block this domain switch to keep the extension off sites you would rather not scan at all.
Where this fits in an authorized workflow is straightforward. For scraping engineers, it replaces the manual DevTools triage phase with a consistent, versioned ruleset. For blue teams and site owners, it is an outside-in view of your own bot posture: are your protections loading everywhere, on every path, at expected confidence? For researchers documenting the anti-bot ecosystem, the JSON rule format and history export make large-scale longitudinal observation practical. The license is NPOSL-3.0 (a non-profit-oriented variant), the repo carries CI, a CHANGELOG.md and an llms.txt, and the ~600 stars suggest an actively maintained, community-watched project from a vendor (Scrapfly) with clear skin in the scraping game.
The main caveats are scope and interpretation. Confidence scores are heuristic and vendor-tied; a 15–90% signal is a lead, not a finding, and the difficulty rating is a triage heuristic rather than a guarantee of scraper survivability. Rule freshness depends on releases, and detection ultimately depends on observable artifacts — a well-obfuscated custom in-house bot check may score nothing even though it exists. Used as a documentary and reconnaissance aid within authorized boundaries, though, Antibot-Detector is one of the more honest examples of the genre: readable rules, explicit scoring semantics, and local-first data handling throughout.
scrapfly/Antibot-Detector.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.