After a long time without side projects, I finally shipped a new one: botstop.io.
The idea is dead simple. You open the page and you instantly get a verdict: human, suspicious or automated. Most signals are available right away, so there is no reason to make you stare at a spinner. A few probes need a little longer, so the page keeps watching and quietly refines the verdict a couple of seconds later if new evidence comes in. That's it. No CAPTCHA, no clicking on fire hydrants.
Behind the scenes, the page passively collects a bunch of browser signals and runs a small anti-replay challenge inside an obfuscated JavaScript VM. I will not spell out the exact checks here, that would only help the people writing the bots. The same detection engine gates signups and logins at ipapi.is, so botstop.io is basically a public playground for it.
A few things I care about in the design:
- Sitting still is not held against you. The page literally asks you to do nothing, so the absence of mouse and keyboard input is not a bot signal here. Only positive evidence counts: well known tells like
navigator.webdriverplus a bunch of quieter ones I will not enumerate. - The individual signals are never shown publicly, only the verdict and a score. If the site showed exactly which probes fired, it would be a free calibration tool for bot authors.
If you write scrapers or browser automation, point them at botstop.io and see what happens. Vanilla headless Chrome scores around 90 and gets flagged as automated. If you manage to look human with a bot, I would honestly love to hear how you did it in the comments.
If you want the theory behind all of this, I wrote about it in On the Architecture of Bot Detection Services and Behavioral Analysis for Bot Detection.