Detection matrix

Kitsune's red-team fleet — real anti-detect tools and browsers — run against the detector. Each card is one evader: its verdict and the convicting tells that caught it. For what each tool actually is, see the annotated evasion catalog.

103evaders
93caught (bot)
10suspicious
accept-lang-spoofbot
score 1.00
br.cdp_runtime_enabled, net.accept_lang_vs_navigator, br.headless_ua +5
apify-fp-injectbot
score 1.00
br.cdp_runtime_enabled, br.permissions_anomaly, br.no_chrome_object +3
audio-noisebot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +4
audio-readback-spoofbot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +4
azuretlsbot
score 1.00
net.h2_header_order_vs_ua, net.tcp_os_vs_ua, net.no_js_execution +1
baseline-firefoxbot
score 0.95
br.webdriver_present
brave-fake-proxybot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +4
brave-fakebot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +4
bravebot
score 0.99
br.webdriver_present, br.headless_ua
camoufox-hardened-behavesuspicious
score 0.49
—
camoufox-hardenedsuspicious
score 0.49
—
camoufox-headfulsuspicious
score 0.47
—
camoufox-linux-coherentsuspicious
score 0.49
—
camoufox-linuxsuspicious
score 0.49
—
camoufox-macosbot
score 0.95
net.tcp_os_vs_ua, br.font_mac_internal
camoufox-socks-webrtcsuspicious
score 0.49
—
camoufox-touch-incoherentbot
score 0.85
br.pointer_touch_incoherent
camoufoxbot
score 1.00
net.tcp_os_vs_ua, net.no_js_execution, net.tls_grease_vs_ua
canvas-geometry-spoofbot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +4
canvas-liebot
score 1.00
br.cdp_runtime_enabled, br.canvas_lie, br.headless_ua +5
canvas-spoofbot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +6
cdc-leakbot
score 1.00
br.webdriver_present, br.cdp_runtime_enabled, br.headless_ua +4
ch-ua-hardcodedbot
score 1.00
net.tcp_os_vs_ua, net.no_js_execution, net.sec_fetch_vs_ua +3
chrome-clone-1bot
score 1.00
br.webdriver_present, br.cdp_runtime_enabled, br.headless_ua +2
chrome-clone-2bot
score 1.00
br.webdriver_present, br.cdp_runtime_enabled, br.headless_ua +2
coalesce-proxybot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +4
coalesce-spoofbot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +4
csp-bypassbot
score 1.00
br.cdp_runtime_enabled, br.csp_bypassed, br.headless_ua +4
curl-http2bot
score 1.00
net.h2_unknown_vs_ua, net.h2_header_order_vs_ua, net.tcp_os_vs_ua +4
curl-impersonatebot
score 0.90
net.no_js_execution
datacenter-origin-proxiedbot
score 1.00
net.datacenter_origin_proxied
domrect-spoofbot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +4
electron-leakbot
score 1.00
br.automation_globals, br.electron_process, br.cdp_runtime_enabled +5
firefox-coherentbot
score 0.95
br.webdriver_present
firefox-os-spoofbot
score 1.00
br.webdriver_present, net.tcp_os_vs_ua, br.navplatform_vs_ua +2
floor-spoofbot
score 1.00
br.tostring_tampered, br.nav_property_spoofed, br.webdriver_getter_tampered +1
font-os-leakbot
score 1.00
br.cdp_runtime_enabled, net.ch_ua_version_vs_ua, net.tcp_os_vs_ua +7
fp-rotationbot
score 0.85
br.fingerprint_unstable_within_session
full-stealthbot
score 1.00
br.cdp_runtime_enabled, net.ch_ua_version_vs_ua, br.ch_he_headless +7
go-tls-h2-rotatebot
score 0.99
net.h2_unknown_vs_ua, net.h2_unstable_within_session, net.no_js_execution
go-tls-madeyouresetbot
score 1.00
net.h2_unknown_vs_ua, net.h2_header_order_vs_ua, net.h2_madeyoureset +3
go-tls-rotatebot
score 1.00
net.h2_unknown_vs_ua, net.ja4_unstable_within_session, net.no_js_execution +2
go-tls-static-extbot
score 1.00
net.h2_unknown_vs_ua, net.tls_ext_order_static_within_session, net.no_js_execution +1
go-tls-web-bot-auth-replaybot
score 0.98
net.web_bot_auth_nonce_replay, net.no_js_execution
go-tls-web-bot-authbot
score 0.98
net.web_bot_auth_invalid, net.no_js_execution
go-tlsbot
score 0.99
net.h2_unknown_vs_ua, net.no_js_execution, net.tls_pq_keyshare_vs_ua
h2-continuation-floodbot
score 0.99
net.h2_continuation_flood, net.no_js_execution
h2-control-floodbot
score 0.99
net.h2_control_flood, net.no_js_execution
h2-rapid-resetbot
score 0.99
net.h2_rapid_reset, net.no_js_execution
h2-settings-splitbot
score 0.96
net.h2_settings_vs_order, net.no_js_execution
honeypotbot
score 1.00
br.webdriver_present, br.cdp_runtime_enabled, br.honeypot_interaction +4
http2-naivebot
score 1.00
net.h2_header_order_vs_ua, net.h2_vs_tls_browser, net.tcp_os_vs_ua +4
human-mousebot
score 1.00
br.webdriver_present, br.cdp_runtime_enabled, br.headless_ua +3
iframe-spoofbot
score 1.00
br.ua_platform_vs_ch_platform, br.cdp_runtime_enabled, net.ch_platform_header_vs_ua +9
ios-ua-spoofbot
score 1.00
net.tls_vs_ua_browser, net.h2_vs_ua_browser, br.ua_platform_vs_ch_platform +11
ip-rotationbot
score 1.00
net.ip_rotation_within_session, net.no_js_execution, net.sec_fetch_vs_ua +2
keystroke-humanbot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +3
lang-list-spoofbot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +4
lang-spoofbot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +4
linear-botbot
score 1.00
br.webdriver_present, br.cdp_runtime_enabled, br.headless_ua +3
max-stealthbot
score 0.99
br.webdriver_spoofed, br.permissions_anomaly, br.no_chrome_object
measuretext-spoofbot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +4
mobile-emulationbot
score 1.00
br.webdriver_present, br.cdp_runtime_enabled, br.ch_he_headless +3
mobile-no-touchbot
score 1.00
net.tls_vs_ua_browser, net.h2_vs_ua_browser, br.automation_globals +11
naive-tz-spoofbot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +6
native-spoofbot
score 1.00
br.native_invariant_violated, br.cdp_runtime_enabled, br.headless_ua +6
nodriverbot
score 0.92
br.headless_ua
os-spoofbot
score 1.00
br.cdp_runtime_enabled, net.ch_ua_version_vs_ua, net.tcp_os_vs_ua +5
patchright-headfulsuspicious
score 0.46
—
patchrightbot
score 1.00
br.headless_ua, br.ch_he_headless, br.permissions_anomaly +1
playwright-extra-coherentbot
score 1.00
br.cdp_runtime_enabled, br.ch_he_headless, br.worker_divergence +2
playwright-extrabot
score 1.00
br.cdp_runtime_enabled, net.tcp_os_vs_ua, br.ch_he_headless +3
primpbot
score 0.97
net.tcp_os_vs_ua, net.no_js_execution
pydollbot
score 0.92
br.headless_ua
quic-no-greasebot
score 1.00
net.no_js_execution, net.sec_fetch_vs_ua, net.accept_encoding_vs_ua +1
rebrowserbot
score 1.00
br.webdriver_present, br.headless_ua, br.permissions_anomaly +1
renderer-spoofbot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +6
screen-impossiblebot
score 1.00
br.screen_impossible, br.cdp_runtime_enabled, br.headless_ua +4
selenium-driverlessbot
score 0.92
br.headless_ua
spoof-uabot
score 1.00
net.tls_vs_ua_browser, net.h2_vs_ua_browser, net.ch_ua_vs_ua_browser +8
stale-enginebot
score 1.00
br.cdp_runtime_enabled, net.ch_ua_version_vs_ua, br.ch_he_headless +5
stealth-naivebot
score 1.00
br.webdriver_present, br.cdp_runtime_enabled, br.headless_ua +3
stealth-patchedbot
score 1.00
br.cdp_runtime_enabled, net.ch_ua_version_vs_ua, net.tcp_os_vs_ua +7
tls-stale-templatebot
score 1.00
net.tcp_os_vs_ua, net.no_js_execution, net.sec_fetch_vs_ua +3
trace-replaybot
score 1.00
bh.trace_replay_within_session, br.cdp_runtime_enabled, br.headless_ua +4
tz-spoofbot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +6
ua-rotationbot
score 1.00
net.h2_unknown_vs_ua, net.h2_header_order_vs_ua, net.ua_rotation_within_session +5
uach-coherentbot
score 1.00
br.cdp_runtime_enabled, br.permissions_anomaly, br.no_chrome_object +1
undetectedbot
score 0.92
br.headless_ua
vanillabot
score 1.00
net.tcp_os_vs_ua, net.no_js_execution, net.sec_fetch_vs_ua +2
webgl-caps-worker-spoofbot
score 1.00
br.automation_globals, net.tls_ext_order_static_within_session, br.webdriver_present +3
webgl-renderer-spoofbot
score 1.00
br.automation_globals, net.tls_ext_order_static_within_session, br.webdriver_present +9
webkit-safari-coherentbot
score 1.00
net.h2_unknown_vs_ua, br.webdriver_present, net.tcp_os_vs_ua +3
webkit-ua-spoofbot
score 1.00
net.tls_vs_ua_browser, net.h2_unknown_vs_ua, net.h2_header_order_vs_ua +8
webrtc-leaksuspicious
score 0.49
—
webrtc-origin-datacenterbot
score 1.00
net.datacenter_origin_proxied
worker-proxy-fixbot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +4
worker-proxybot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +4
worker-spoofbot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +4
worker-wrapbot
score 1.00
br.cdp_runtime_enabled, br.headless_ua, br.ch_he_headless +4
zendriver-uach-behavesuspicious
score 0.49
—
zendriver-uachsuspicious
score 0.50
—
zendriverbot
score 0.80
net.h2_header_order_vs_ua