Probe
Probe is being built as a benchmarking layer across the bot-protection ecosystem. Test your own browser, scraper, crawler or HTTP client against independent detection techniques and against real protection products wherever direct integration or controlled test environments are available.
The goal is not a single generic "bot score." Probe will show how the same client is classified across different protection systems, signal families and network-intelligence sources.
In development · Pre-launch
Product outcomes and independently observed signals are reported separately. A signal WhoScrapes observes is not presented as the reason a product made its decision unless the vendor exposes that information. No source code upload and no SDK required; you do not need WhoScrapes Run to use Probe.
Active protection testing is intended for domains you own or are authorized to test, confirmed through DNS TXT, an HTTP verification file, or an account-level domain ownership workflow.
Different anti-bot systems make different decisions about the same client. Probe is designed to test that difference directly: a standardized benchmark harness for the bot-protection ecosystem, with WhoScrapes' own detectors explaining and complementing the product outcomes.
Detection is not limited to browser anti-bot products. Probe plans to compare independent IP and network-intelligence providers too; the disagreement between them is itself a useful result.
Examples represent technologies WhoScrapes intends to research or integrate with. No affiliation, partnership or completed integration is implied. Names are trademarks of their respective owners.
A protection system is not a signal. Probe keeps the two apart: the product outcome says what happened, the detection layers help explain it.
| Protection ↓ / Layer → | TLS | Browser | IP | Behavior | Session |
|---|---|---|---|---|---|
| Cloudflare | |||||
| DataDome | |||||
| Akamai | |||||
| AWS |
A detection result is only useful if you know what produced it. Probe is designed to label each result with one of five sources. Native and Controlled are real-product benchmarks.
Real-product benchmarks
The actual vendor product or API evaluates the request: through a vendor API or SDK, a WhoScrapes-controlled hostname configured behind the product, or a supported edge / WAF integration. This is the strongest result.
A real protection product evaluates the client in an environment operated by WhoScrapes, provided by a benchmark partner, or explicitly authorized for benchmarking. This matters for enterprise systems that cannot simply be called through an API. The product is real even when WhoScrapes has no access to its proprietary internal score.
Potential future coverage: Akamai Bot Manager, HUMAN / PerimeterX, F5 / Shape, Imperva, DataDome, Kasada, Radware, Netacea.
Detectors & research
WhoScrapes implements and measures the detector itself.
JA4 / TLS, HTTP/2, header consistency, browser / runtime consistency, CDP instrumentation, JavaScript integrity, WebGL / Canvas / device signals, behavior, session continuity, IP / network classification, honeypots, WAF rules.
WhoScrapes implements a comparable signal family based on public vendor documentation and research.
Browser inconsistency, automated-browser signals, token / session reuse, suspicious navigation, environment spoofing, coordinated activity, sensor tampering, unusual request signatures. Modeled results do not claim to reproduce a vendor's proprietary scoring model.
The result comes from publicly observable behavior or research rather than direct access to the protection system.