my-project/config/openclaw/skills/camoufox-stealth/references/fingerprint-checks.md

Browser Fingerprint Checks

What anti-bot systems check and how to evade.

Detection Layers

┌─────────────────────────────────────────────┐
│           Layer 1: Network/IP               │
│  • IP reputation score                      │
│  • Datacenter vs residential                │
│  • Geo-location consistency                 │
├─────────────────────────────────────────────┤
│           Layer 2: TLS Fingerprint          │
│  • JA3/JA4 hash                            │
│  • Cipher suite order                       │
│  • TLS extensions                           │
├─────────────────────────────────────────────┤
│           Layer 3: HTTP Headers             │
│  • User-Agent consistency                   │
│  • Header order                             │
│  • Accept-Language                          │
├─────────────────────────────────────────────┤
│           Layer 4: Browser Fingerprint      │
│  • navigator.webdriver                      │
│  • Canvas/WebGL hash                        │
│  • Audio fingerprint                        │
│  • Font enumeration                         │
├─────────────────────────────────────────────┤
│           Layer 5: Behavioral               │
│  • Mouse movements                          │
│  • Scroll patterns                          │
│  • Timing analysis                          │
│  • Click patterns                           │
└─────────────────────────────────────────────┘

Specific Checks & Countermeasures

1. navigator.webdriver

What: navigator.webdriver returns true for automated browsers.

Check:

navigator.webdriver  // true = bot

Countermeasure:

• Nodriver: Automatically patches
• Camoufox: Patched at C++ level
• Playwright-stealth: delete navigator.webdriver (weak, can be detected)

2. Chrome DevTools Protocol (CDP)

What: Presence of CDP side-channels reveals automation.

Check:

// Sites check for CDP artifacts
window.cdc_adoQpoasnfa76pfcZLmcfl_Array
window.cdc_adoQpoasnfa76pfcZLmcfl_Promise

Countermeasure:

• Nodriver: Uses CDP but patches artifacts
• Camoufox: No CDP (native Firefox)
• Patchright: Patches CDP artifacts

3. Canvas Fingerprint

What: Each GPU/driver combo renders slightly differently.

Check:

canvas.toDataURL()  // Unique hash per system

Countermeasure:

• Camoufox: Injects deterministic noise
• Some detection tools look for perfectly identical canvas = bot

4. WebGL Fingerprint

What: GPU vendor/renderer strings.

Check:

gl.getParameter(gl.RENDERER)  // "ANGLE (Intel HD Graphics)"
gl.getParameter(gl.VENDOR)    // "Google Inc."

Countermeasure:

• Camoufox: Spoofs to common values
• Avoid VMs with "llvmpipe" or "SwiftShader" (instant bot flag)

5. Audio Fingerprint

What: AudioContext processing variations.

Check:

new AudioContext().createOscillator()  // Unique waveform

Countermeasure:

• Camoufox: Adds noise to audio processing

6. Font Enumeration

What: Bots often have minimal fonts installed.

Check:

// Test if specific fonts render
document.fonts.check('12px "Segoe UI"')

Countermeasure:

• Install standard fonts in your environment
• Camoufox: Spoofs font list

7. Screen/Window Size

What: Unusual dimensions = bot.

Check:

screen.width, screen.height
window.innerWidth, window.innerHeight

Countermeasure:

• Use standard resolutions: 1920x1080, 1366x768
• Avoid: 800x600, odd dimensions

8. Timezone Consistency

What: Timezone must match IP geo-location.

Check:

Intl.DateTimeFormat().resolvedOptions().timeZone
new Date().getTimezoneOffset()

Countermeasure:

• Set timezone to match proxy location:

  TZ="America/New_York" python script.py
  

9. Language Consistency

What: Browser language should match geo.

Check:

navigator.language       // "en-US"
navigator.languages      // ["en-US", "en"]

Countermeasure:

• Configure browser locale to match proxy:

  # Camoufox
  async with AsyncCamoufox(locale="en-US") as browser:
  

10. Hardware Concurrency

What: VMs often report 1-2 CPUs.

Check:

navigator.hardwareConcurrency  // 1 or 2 = suspicious

Countermeasure:

• Camoufox: Spoofs to 4-8
• Or use real hardware, not minimal VM

11. Headless Detection

What: Multiple signals reveal headless mode.

Checks:

navigator.plugins.length === 0
navigator.mimeTypes.length === 0
window.chrome === undefined

Countermeasure:

• Use "new headless" mode: headless="new"
• Or run headed in Xvfb
• Camoufox headless is well-patched

12. Mouse/Keyboard Events

What: Bots often have no mouse history.

Check:

// Sites track mouse movement patterns
document.addEventListener('mousemove', analyze)

Countermeasure:

• Inject random mouse movements
• Nodriver/Camoufox: Built-in human-like movement
• Don't teleport cursor - use bezier curves

Test Sites

Check your stealth setup:

Site	What It Tests
https://bot.sannysoft.com	Comprehensive bot detection
https://browserleaks.com	All fingerprints
https://nowsecure.nl	Cloudflare detection
https://pixelscan.net	Bot detection score
https://abrahamjuliot.github.io/creepjs	Advanced fingerprinting

Tool Comparison

Check	Camoufox	Plain Playwright
webdriver	✅	❌
CDP artifacts	✅ (no CDP)	❌
Canvas	✅	❌
WebGL	✅	❌
Audio	✅	❌
Fonts	✅	❌
Headless	✅	❌
TLS	✅	❌

Legend: ✅ = patched, ❌ = detected