# Pixelscan automated behavior detected: what reproduced

> Pixelscan's automated behavior detected card never came back on our own platform beside stock Chrome. The foreign platform claim failed four times in four.

Source: https://mosaicbrowser.com/blog/pixelscan-automated-behavior-card

## Pixelscan's automated behavior card, reproduced and not

Pixelscan's automated behavior detected card never came back on our own platform beside stock Chrome. The foreign platform claim failed four times in four.

![4 of 4: The bot card was never the bug, beside a screenshot: creating a profile in Mosaic: a checked proxy, and the hardware and locale drawn to match its exit](https://mosaicbrowser.com/covers/pixelscan-automated-behavior-card.webp)

Pixelscan's "Automated behavior detected" card is the part of the result everyone screenshots, and in the case that sent us looking, it was the one red card we could not make appear again. A fresh profile on our Mac's own platform, run three times beside an untouched Google Chrome, passed the bot check every time. What did reproduce, four times in four, was the platform the profile claimed. The bot card was never the bug.

## The screenshot that started it

The report was a Pixelscan page with two red cards, "Your Browser Fingerprint is inconsistent" and "Automated behavior detected", over a profile whose User-Agent said Edge on Windows. Read top to bottom it looks like one story: the site caught a bot, and the bot was badly disguised.

It was two stories. The Edge part was ours and is settled: the engine cannot spell Edge correctly in both the User-Agent and the client-hint version lists at once, so Mosaic refuses the Edge brand and profiles claim Chrome. That left the bot card and the inconsistency, and we tested them separately, because one failing card does not explain another.

Mosaic is a desktop app

Email yourself the link and open it on your computer.

[How it works: Machines that exist](https://mosaicbrowser.com/features/real-fingerprints)

## Trying to reproduce Pixelscan's automated behavior detected card

We ran one fresh profile on this computer's own platform, no proxy, through our detector runner, `scripts/run-detection-tests.mjs --only pixelscan --rounds 3 --control`. The `--control` flag runs the same page in an untouched Google Chrome on the same machine and the same address:

| Browser | Three rounds |
| --- | --- |
| Mosaic profile, macOS on a Mac | fingerprint consistent, no masking, no automated behaviour |
| Stock Google Chrome | fingerprint consistent, no masking, no automated behaviour |

Five green cards, Bot check included. The second row is the reason the first one means anything. If the stock browser had come back red too, the card would be telling us about Pixelscan or about the network, and nothing about the profile.

We also checked the two things that most often do set off bot checks. `navigator.webdriver` read `false`, and it matters here because Pixelscan's collector script names a `webDriver` field among what it gathers. And nothing in Mosaic enables the Chrome DevTools Protocol's `Runtime` domain on a page.

That second one is not a guess. We had measured it earlier on deviceandbrowserinfo, one fresh profile per row:

| CDP call | Verdict |
| --- | --- |
| `Runtime.enable` | isBot=true, flagged `isAutomatedWithCDP` |
| `Page.enable` | isBot=false |
| `Runtime.evaluate` | isBot=false |
| `Input.dispatchKeyEvent` | isBot=false |

We had shipped `Runtime.enable` in five places (warm-up, typing, credential fill, synchronised typing and the shared page session), so a profile was clean at launch and detectable the moment anyone used it. All five came out, and a build check, `check:stealth`, now fails if the string appears anywhere in the source. Pixelscan's server does not tell us what its bot check weighs, so we can't say it reads the same thing. We can say the profile in front of it did not do it.

## What did reproduce, four times in four

Then we changed one thing, the platform the profile claims, and ran the page the same way. Same Mac, same engine, no proxy on any row:

| Claimed platform | Pixelscan headline |
| --- | --- |
| macOS (this computer), twice | consistent, no masking |
| Linux | inconsistent, "Masking detected" |
| Windows, three profiles | still "scanning…" at 90 seconds |

Both macOS runs passed. All four foreign claims went wrong, one as a masking verdict and three as a scan that never finished. Pixelscan's own readout shows why on the Linux row: 159 fonts on the macOS claim, one on the Linux claim. The fonts installed come from the computer, and the claim asks for another computer's list. The Windows rows are a scan that never ends, which [when Pixelscan never stops scanning](https://mosaicbrowser.com/blog/pixelscan-stuck-on-scanning) takes apart, and the font surface is bisected in [Pixelscan's masking verdict](https://mosaicbrowser.com/blog/pixelscan-masking-bisected).

So the original screenshot was a foreign platform claim, which reproduces, sitting next to a bot card, which does not. The strongest match a profile can make is the OS its own computer runs, and [a Mac makes Mac profiles](https://mosaicbrowser.com/blog/a-mac-makes-mac-profiles) explains why no switch inside the engine reaches the fonts.

## Pixelscan disagrees with itself, Google's Chrome included

A card that does not reproduce on one run might on the twentieth, so we kept going. We ran an untouched Google Chrome against Pixelscan 20 times, off-screen and headed, a fresh profile directory each time, same machine and address. It came back clean 16 times, "inconsistent, Masking detected" 3 times, and once with no verdict.

Our own profiles across the same kind of sweep, 74 observations on fresh profiles, came back with one masking verdict, on a device that then passed nine runs in a row. A verdict that Google's own browser earns about one run in six is not evidence about anything until it repeats.

## The fault we found in our own evidence

One more thing turned up while we were reading screenshots. The `--control` run wrote its picture to the same file as the profile's run, so every controlled run ended with the "evidence" image showing the other browser. Both images are a Pixelscan result page and the only tell is a version string in a card. We caught it on a row where our profile read `unread`, stock Chrome read pass, and the saved picture showed a pass.

The control now writes its own `<id>.control.png` beside the profile's shot, and the report links both. If you are collecting Pixelscan screenshots as proof of anything, check which browser took each one, and run the stock control before you trust a red card. The values Mosaic draws to match the machine it runs on are listed on [real fingerprints](https://mosaicbrowser.com/features/real-fingerprints).

## Questions

### What does Pixelscan's automated behavior detected card mean?

It is Pixelscan's bot check. Its collector script declares a webDriver field among what it gathers, and the verdict is computed on Pixelscan's server, so the page does not say which reading tipped it.

### Can a normal browser get the automated behavior card?

Run an untouched Google Chrome on the same computer and connection first. If the stock browser gets the same card, it is not a finding about your profile.

### Does Chrome DevTools Protocol automation trigger bot checks?

Some of it does. We measured Runtime.enable alone flipping deviceandbrowserinfo to isBot=true, while Page.enable, Runtime.evaluate and dispatched key events did not.

### Why did my profile show inconsistent and automated at the same time?

In the case we investigated, the profile claimed a different desktop OS from the computer it ran on. The inconsistency reproduced every time; the bot card did not reproduce at all.

## Related

[When Pixelscan never stops scanning](https://mosaicbrowser.com/blog/pixelscan-stuck-on-scanning): Pixelscan stuck on scanning for 90 seconds was, in our runs, a profile claiming Windows on a Mac. A scan that never returns is a non-verdict, not a slow pass.

[Pixelscan's masking verdict, bisected to one surface](https://mosaicbrowser.com/blog/pixelscan-masking-bisected): We bisected Pixelscan's masking detected verdict on one profile. Canvas, WebGL, audio and client rects were fine. Hiding about 2% of font families caused it.

[Why OS spoofing fails on fonts: a Mac makes Mac profiles](https://mosaicbrowser.com/blog/a-mac-makes-mac-profiles): Why OS spoofing fails on fonts: they come from the computer, not the claim. A Linux profile made on our Mac showed 1 font where macOS showed 159.

[Machines that exist: fingerprints drawn from real hardware](https://mosaicbrowser.com/features/real-fingerprints): Mosaic draws each profile's GPU, screen, CPU, memory and fonts from one real device, so the parts of a fingerprint agree with each other and with the host.

[A detector that never answered because its tab was in the background](https://mosaicbrowser.com/blog/requestanimationframe-background-tab): Background tab throttling stops requestAnimationFrame. Our test tab was in the background, two detectors never answered, and Page.bringToFront fixed both.

[Why navigator.webdriver is true, and why false proves little](https://mosaicbrowser.com/blog/why-navigator-webdriver-true): navigator.webdriver is true because automation set it on purpose. We measured a debug-attached Chrome reading true and still scoring 100 on IPHey.

[fingerprint-scan.com bot score: 0 before anything was measured](https://mosaicbrowser.com/blog/bot-score-before-measuring): fingerprint-scan.com shows Bot score 0/100 while its hash still reads collecting. Read the score only after the hash exists, and expect 15, not 0.

[49 browser fingerprint detectors, and how we read them](https://mosaicbrowser.com/blog/forty-nine-detectors): Our browser fingerprint detectors list: 49 public test pages in five groups, 40 read by a script and 9 kept as reference because they print no verdict.

## Mosaic, on your own computer

The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number.

Mosaic is a desktop app

Email yourself the link and open it on your computer.