Antoine Vastel's fp-scanner demo used to live at antoinevastel.com/bots/. It is gone, and that address now serves his personal homepage: a portrait, a biography and three navigation links. The library is still on GitHub. The hosted page that ran it in your browser is not, and when we checked, his own Projects page pointed to deviceandbrowserinfo.com/are_you_a_bot and fingerprint-scan.com instead.
We found this through our detector catalogue, the one list of public test pages that Mosaic can open a profile against. Finding it was easy. The second row from the same site was harder, because it looked like it was working.
The row that would have passed
Our catalogue had a row called datadome-bots, pointing at antoinevastel.com/bots/datadome. That path serves the same homepage as /bots/, byte for byte, with HTTP 200.
A 200 is never recorded as unreachable, since the server answered. And the row was read by our challenge reader, whose rule is short: if the page loads and there is no challenge text on it, the browser got through. A homepage with a portrait on it has no challenge text, so every profile we pointed at it would have come back clean. So would a stock Chrome, a headless one, and a script with no browser at all.
A test that fails for no reason gets looked at the same day. A test that passes everything gets cited, which is why a dead page answering 200 does more damage than one that answers 404. We deleted the row instead of fixing it, because another row, datadome-demo, already covers DataDome.
Everything the window does, from a script on your own computerIn Mosaic: REST API. Everything the window does, from your own scripts. Free holds 3 profiles. Pro is $49 a month for any number.
Mosaic is a desktop app
Email yourself the link and open it on your computer.
Four ways a test page dies
Third-party test sites get redesigned and retired. We have seen four kinds, listed from the easiest to catch to the hardest.
- Gone, and saying so: BrowserLeaks'
/webaudiopage returns 404. So does every path a rename would plausibly use, and the site's ownsitemap.xmllists no audio page. Nothing is coming back. - Host up, application down:
arh.antoinevastel.com/bots/areyouheadlessanswered 502 on six probes over a minute while the host root answered 200. Three runs of the suite agreed onunreachable. By then his Projects page listed no demos at all, so there was no successor to follow. - The name does not resolve:
perfect-privacy.comreturned SERVFAIL from both Cloudflare's and Google's DNS-over-HTTPS resolvers, whilednsleaktest.comandexample.comin the same batch resolved normally. When two independent resolvers agree, the domain is broken for everybody and the cause is not your machine. - A normal page with nothing on it, the
datadome-botscase. It is the only one of the four that no status code catches.
And one that only looked dead. Our runner once reported dnsleaktest.com as unreachable. It was alive and serving 200; its Standard and Extended test buttons are <input> elements, and our probe was looking for a and button and reading textContent. The site had not been redesigned. Our selector was wrong.
A page can also answer before it has measured
fingerprint-scan.com, one of fp-scanner's successors, showed a related problem. A screenshot from one of our runs had the hash fields still reading collecting…, the summary reading 0 visible signals across 0 categories, and the badge already saying Bot score 0/100. A reader that took the score alone would have called a page that had measured nothing a perfect pass.
So our reader for it now requires the hash and a non-zero signal count before the score means anything, and we raised its settle time from 20 seconds to 45.
Where Antoine Vastel's fpscanner tests went
When a test page stops answering, the useful question is where the test moved. A verdict about the profile can wait for that answer. For fp-scanner the answer took one visit to the author's Projects page, and both successors were already in our list, so deleting the row lost no coverage. For areyouheadless there was no successor. Headless detection is still read by bot.sannysoft.com, the Rebrowser bot detector, deviceandbrowserinfo, BrowserScan's bot check and four commercial bot walls, so removing that row lost nothing either.
The runner's rules came out of rows like these. A test that did not run is never a pass: no answer is unreachable, and a page whose verdict the reader cannot find is unread. A row that can never answer gets deleted, so a permanent blank does not sit in the report looking like a gap in coverage. The full list, with the five groups and how each is read, is in our 49 detectors.
The same habit applies outside the catalogue. If you run these checks from your own scripts, keep the screenshot from every run and read it the first time a result surprises you. Ours is how four rows got real readers without launching a browser (what we learned automating fingerprint tests covers the runner itself). Run each test against a fresh profile per run, and drive the page without switching on the DevTools Runtime domain, which some bot tests read as a signal (the Runtime.enable story).
