Bot Detection Sandbox
Navigate the challenge pages below. Each page instruments your mouse, keyboard, scroll, and browser fingerprint — the same signals real platforms use to detect bots.
Session: 28fd2749b1e326d484e4a2f7d26f5cf5
Challenge Pages
🔑
Login
Keyboard timing on email/password, mouse path to fields, hover-before-click
📰
Feed
Scroll behavior, click precision on like/reply, action pacing between posts
✏️
Compose
Keystroke distribution, word/sentence pauses, typo correction, hover before Post
👤
Profile
Navigation across tabs, idle reading time on bio, no-interaction dwell
📖
Article
Reading speed (~250 WPM), scroll increment variability, regression scrolls
📊
Score API
Raw JSON endpoint — returns all 34 signal scores, data exposure, and raw stats
📝
Forms
Multi-field registration — text, email, phone, dropdowns, radio, checkbox, honeypot
🧭
Wizard
3-step wizard — multi-page navigation, per-step validation, review and confirm
🚧
Obstacles
Gauntlet — fake CAPTCHA, honeypot, delayed fields, custom dropdown, disabled submit
Real-World Challenges
Simulate real internet obstacles — CAPTCHAs, OAuth, 2FA, cookie consent, rate limits. Each challenge tests different behavioral signals that distinguish humans from bots.
🍪
Cookie Consent
Banner dismiss timing, reading behavior. Humans take 1-5s; bots dismiss instantly.
🛡️
Bot Wall
Idle fidgeting during wait, checkpoint click, image selection challenge.
🎚️
Slider CAPTCHA
Drag trajectory wobble, speed profile (slow-fast-slow), alignment precision.
⏳
Rate Limit
Retry patience, interval variability. Bots retry at uniform intervals.
🔐
OAuth/SSO
Cross-page behavioral consistency through login → consent → callback flow.
📱
2FA Entry
Numeric keystroke timing, mouse gaze proxy between code display and input.
♾️
Dynamic Feed
Infinite scroll with lazy loading. Tests pause at loading boundaries.
🖼️
Image Grid
Multi-target click precision, non-sequential selection order, timing variation.
Bot Verification Challenges
Inverse CAPTCHA — prove you're a bot. These challenges test for machine-level precision, superhuman speed, and sub-human reaction times that humans physically cannot achieve.
🎯
Precision Grid
Click 50 targets with sub-pixel accuracy. Humans can't consistently hit 8x8px targets dead-center.
⚡
Speed Typing
Type at >500 chars/sec sustained. Human world record is ~15 chars/sec.
🧠
Pattern Match
React faster than human limit (~150ms). Sub-100ms reactions are physically impossible for humans.
Agent Planning Challenges
Measure agent decision quality, not just behavioral signals. These pages test field mapping accuracy, safety tier compliance, dynamic form adaptation, error recovery, and sequential obstacle resolution.
🧭
Field Mapping
10 fields with obfuscated labels — agent must map to correct vault keys (email, phone, name, etc.)
🛡️
Safety Tiers
AUTO/CONFIRM/ESCALATE/BLOCK fields + honeypots. BLOCK violations = immediate failure.
🔄
Dynamic Forms
Fields revealed by JS after action. Agent must re-snapshot and adapt. Conditional field on admin username.
🔄
Error Recovery
First submission always rejected with fake error. Agent must detect, adapt, and retry.
⛓️
Obstacle Chain
5 sequential obstacles: CAPTCHA → honeypot → delayed button → scroll-to-reveal → 2FA entry.
How It Works
- Navigate each challenge page (or click "Run All")
- Interact naturally — or point your bot at it
- JavaScript captures every event (same as real platforms)
- Visit the Report page to see your 34-signal score breakdown
34 Detection Signals
| # | Signal | Weight | What It Measures |
|---|---|---|---|
| 1 | Mouse path curvature | 15% | Bezier curves vs straight lines |
| 2 | Mouse speed variability | 10% | Bell-curve acceleration vs constant speed |
| 3 | Click precision | 10% | Offset from element center |
| 4 | Hover-before-click | 8% | Mouseenter precedes click |
| 5 | Keystroke timing | 15% | Gaussian distribution of inter-key delays |
| 6 | Scroll behavior | 12% | Variable increments, pauses, regressions |
| 7 | Dwell time | 10% | Reading time proportional to content |
| 8 | Action pacing | 10% | Variable delays between interactions |
| 9 | Overshoot | 5% | Cursor passes target, pauses, corrects |
| 10 | Fingerprint | 5% | Browser environment cleanliness |
| Hardening Signals (11-22) | |||
| 11-22 | 12 hardening signals | ~30% | Scroll jump, timing fit, direction changes, velocity asymmetry, CSS fingerprint, stealth artifacts, event trust, spatial efficiency, vocabulary, typing burst, content naturalness, path uniqueness |
| Real-World Signals (23-34) | |||
| 23 | Overlay reaction | 3% | Reaction time to modals/banners (1-5s = human, <500ms = bot) |
| 24 | Drag trajectory | 3% | Vertical wobble during horizontal drag (humans wobble, bots go straight) |
| 25 | Retry behavior | 2% | Retry interval variability (uniform = bot, variable = human) |
| 26 | LLM text detection | 2% | Lexical diversity and hapax ratio to distinguish human vs LLM-generated text |
| 27 | Fingerprint coherence | 2% | GPU-OS coherence, resolution vs UA match, CJK language without CJK fonts |
| 28 | Geo consistency | 2% | Timezone-language coherence and script coherence (non-Latin language, ASCII-only keystrokes) |
| 29 | Event ordering | 2% | Causal event sequence validity — clicks preceded by mousemove, keydown/keyup pairing |
| 30 | First interaction delay | 2% | Time between page load and first interaction (1-5s = human scan time, <500ms = bot) |
| 31 | Idle detection | 2% | Natural idle periods (5-30s) between actions — bots execute with no thinking pauses |
| 32 | Tab visibility | 2% | Real users switch tabs; bots maintain constant focus with no visibility changes |
| 33 | Pointer/touch consistency | 2% | Cross-references touch support claim vs actual event types (spoofed fingerprint detection) |
| 34 | JS execution timing | 2% | Variance in JS execution timestamps — synthetic injection produces unnaturally uniform timing |