# Antoine Vastel's fpscanner demo is gone, and answers 200 > Antoine Vastel's fp-scanner demo now serves his homepage with HTTP 200, which a challenge reader scores as a pass. His tests moved; here is where. Source: https://mosaicbrowser.com/blog/dead-detector-returns-200 ## A retired bot test can still answer 200 and look like a pass Antoine Vastel's fp-scanner demo now serves his homepage with HTTP 200, which a challenge reader scores as a pass. His tests moved; here is where. ![200: A homepage where the bot test used to be](https://mosaicbrowser.com/covers/dead-detector-returns-200.webp) Antoine Vastel's fp-scanner demo used to live at `antoinevastel.com/bots/`. It is gone, and that address now serves his personal homepage: a portrait, a biography and three navigation links. The library is still on GitHub. The hosted page that ran it in your browser is not, and when we checked, his own Projects page pointed to `deviceandbrowserinfo.com/are_you_a_bot` and `fingerprint-scan.com` instead. We found this through our detector catalogue, the one list of public test pages that Mosaic can open a profile against. Finding it was easy. The second row from the same site was harder, because it looked like it was working. ## The row that would have passed Our catalogue had a row called `datadome-bots`, pointing at `antoinevastel.com/bots/datadome`. That path serves the same homepage as `/bots/`, byte for byte, with HTTP 200. A 200 is never recorded as `unreachable`, since the server answered. And the row was read by our challenge reader, whose rule is short: if the page loads and there is no challenge text on it, the browser got through. A homepage with a portrait on it has no challenge text, so every profile we pointed at it would have come back clean. So would a stock Chrome, a headless one, and a script with no browser at all. A test that fails for no reason gets looked at the same day. A test that passes everything gets cited, which is why a dead page answering 200 does more damage than one that answers 404. We deleted the row instead of fixing it, because another row, `datadome-demo`, already covers DataDome. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: REST API](https://mosaicbrowser.com/features/rest-api) ## Four ways a test page dies Third-party test sites get redesigned and retired. We have seen four kinds, listed from the easiest to catch to the hardest. - Gone, and saying so: BrowserLeaks' `/webaudio` page returns 404. So does every path a rename would plausibly use, and the site's own `sitemap.xml` lists no audio page. Nothing is coming back. - Host up, application down: `arh.antoinevastel.com/bots/areyouheadless` answered 502 on six probes over a minute while the host root answered 200. Three runs of the suite agreed on `unreachable`. By then his Projects page listed no demos at all, so there was no successor to follow. - The name does not resolve: `perfect-privacy.com` returned SERVFAIL from both Cloudflare's and Google's DNS-over-HTTPS resolvers, while `dnsleaktest.com` and `example.com` in the same batch resolved normally. When two independent resolvers agree, the domain is broken for everybody and the cause is not your machine. - A normal page with nothing on it, the `datadome-bots` case. It is the only one of the four that no status code catches. And one that only looked dead. Our runner once reported `dnsleaktest.com` as unreachable. It was alive and serving 200; its Standard and Extended test buttons are `` elements, and our probe was looking for `a` and `button` and reading `textContent`. The site had not been redesigned. Our selector was wrong. ## A page can also answer before it has measured `fingerprint-scan.com`, one of fp-scanner's successors, showed a related problem. A screenshot from one of our runs had the hash fields still reading `collecting…`, the summary reading `0 visible signals across 0 categories`, and the badge already saying `Bot score 0/100`. A reader that took the score alone would have called a page that had measured nothing a perfect pass. So our reader for it now requires the hash and a non-zero signal count before the score means anything, and we raised its settle time from 20 seconds to 45. ## Where Antoine Vastel's fpscanner tests went When a test page stops answering, the useful question is where the test moved. A verdict about the profile can wait for that answer. For fp-scanner the answer took one visit to the author's Projects page, and both successors were already in our list, so deleting the row lost no coverage. For areyouheadless there was no successor. Headless detection is still read by bot.sannysoft.com, the Rebrowser bot detector, deviceandbrowserinfo, BrowserScan's bot check and four commercial bot walls, so removing that row lost nothing either. The runner's rules came out of rows like these. A test that did not run is never a pass: no answer is `unreachable`, and a page whose verdict the reader cannot find is `unread`. A row that can never answer gets deleted, so a permanent blank does not sit in the report looking like a gap in coverage. The full list, with the five groups and how each is read, is in [our 49 detectors](https://mosaicbrowser.com/blog/forty-nine-detectors). The same habit applies outside the catalogue. If you run these checks from your own scripts, keep the screenshot from every run and read it the first time a result surprises you. Ours is how four rows got real readers without launching a browser ([what we learned automating fingerprint tests](https://mosaicbrowser.com/blog/automating-fingerprint-tests) covers the runner itself). Run each test against a [fresh profile per run](https://mosaicbrowser.com/blog/fresh-profile-per-test-run), and drive the page without switching on the DevTools `Runtime` domain, which some bot tests read as a signal ([the Runtime.enable story](https://mosaicbrowser.com/blog/runtime-enable-detection)). ## Questions ### Is Antoine Vastel's fpscanner demo still online? The hosted demo at antoinevastel.com/bots/ is not. That address now shows his personal homepage. The fp-scanner library itself is still on GitHub, so you can run its checks yourself. ### What can I use instead of the fpscanner demo? His own Projects page pointed to two live tests when we checked: deviceandbrowserinfo.com/are_you_a_bot and fingerprint-scan.com. Both print a bot verdict, and both are in Mosaic's detector catalogue. ### Why would a dead test page count as a pass? A reader for a challenge page passes the browser when the page loads and shows no challenge. A retired demo that serves a normal homepage with HTTP 200 loads and shows no challenge, so a lazy reader records a clean run on every browser. ### What happened to areyouheadless? Its path on arh.antoinevastel.com answered 502 on six probes over a minute while the host root answered 200. By then his Projects page listed no demos at all, so there was no successor, and we removed the row. ## Related [49 browser fingerprint detectors, and how we read them](https://mosaicbrowser.com/blog/forty-nine-detectors): Our browser fingerprint detectors list: 49 public test pages in five groups, 40 read by a script and 9 kept as reference because they print no verdict. [Running 49 fingerprint tests unattended, and what that takes](https://mosaicbrowser.com/blog/automating-fingerprint-tests): To automate browser fingerprint testing, tell a failed profile from a dead site, an unreadable page and your own bug. Our runner names each across 49 rows. [Runtime.enable flips a detector, so we don't call it](https://mosaicbrowser.com/blog/runtime-enable-detection): Runtime.enable detection, measured: one DevTools command turned a clean Mosaic profile into isBot=true on deviceandbrowserinfo. We removed all five calls. [A fresh browser for every test run, and why it should be cheap](https://mosaicbrowser.com/blog/fresh-profile-per-test-run): Leftover cookies and storage are where flaky browser tests come from. A one-time profile gives each run a clean jar and trashes itself when its browser closes.    [Behaviour tests score your mouse, not just your browser](https://mosaicbrowser.com/blog/behavioral-bot-detection-test): A behavioral bot detection test scores mouse paths and dwell next to browser attributes. Load one and touch nothing, and the score describes your stillness. ## Mosaic, on your own computer The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.