01 Specimen Data extraction at scale
Large-scale crawlers built to harvest catalogues, prices, and competitive intelligence without respecting platform limits.
Bots, Labs & Sandboxes
Evidence for every defense. Map. Practice. Tune.
Map bot variants, follow guided lab tracks, and test defensive tradeoffs in safe sandboxes built for defenders.
Bots · BLS-01
Know the variants before you tune the defense.
Each family has different economics, infrastructure, evasion habits, and evidence. The bot map gives you the lay of the land before the lab work begins.
01 Specimen 
02 Specimen Automated login attacks
Credential testing systems that turn leaked usernames and passwords into account takeover pressure.
03 Specimen Inventory hoarding and sniping
Inventory and checkout automation built to reserve stock, win queues, and bypass purchase limits.
04 Specimen Content flooding and manipulation
Account farms and posting systems that flood reviews, comments, and social surfaces past moderation.
05 Specimen Synthetic content at scale
Synthetic content operations combining agents, templates, and feedback loops to produce material at industrial scale.
06 Specimen Evasion through fingerprint spoofing
Anti-detect browser profiles tuned to look ordinary while still leaking contradictions under pressure.
Lab Tracks · BLS-02
Choose the evidence path you need.
The labs work the bot-defense stack one layer at a time — from the device underneath the request up to the business cost it lands on. Each layer turns a problem into evidence: a collector, detector, scoring module, or runbook.
Track 01 / 08 Layer I
Hardware & Device
Read the device underneath the browser. Clock drift, GPU rendering quirks, sensor noise, and display geometry rarely fake themselves coherently — that incoherence is your first signal.
Artifact Device coherence profile
Signals
- Clock drift
- GPU
- Sensors
- Display
Use case Emulator and farm detection
Track 02 / 08 Layer II
Network Origin & Reputation
IP context, autonomous-system reputation, residential vs. data-center routing, and impossible-travel velocity. The layer that catches the cheapest automation before it lands.
Artifact IP risk scoring module
Signals
- IP
- ASN
- Proxy
- Geo velocity
Use case Proxy and ASN triage
Track 03 / 08 Layer III
Transport Fingerprints
JA3/JA4 TLS prints, HTTP/2 frame ordering, TCP fingerprints, and header shape. Verdicts you can ship before a single line of JavaScript runs.
Artifact Transport-layer signature ruleset
Signals
- JA3/JA4
- HTTP/2
- TCP
- Headers
Use case Pre-JS verdicts
Track 04 / 08 Layer IV
Browser Runtime Signals
JS timing, Canvas and WebGL fingerprints, and permission-prompt behavior. The rich runtime evidence that exposes stock automation and most anti-detect patches.
Artifact Runtime signal collector and challenge review
Signals
- JS timing
- Canvas
- WebGL
- Permissions
Use case Headless and patch detection
Track 05 / 08 Layer V
Identity & Session Lineage
Stitch fingerprint, cookie age, account graph, and session lineage together so spun-up accounts cannot pretend to be returning users.
Artifact Session lineage tracer
Signals
- Fingerprint
- Cookie age
- Session lineage
Use case Account-takeover defense
Track 06 / 08 Layer VI
Behavioral Analytics
Turn mouse, keyboard, scroll, and dwell traces into features, models, and explanations that respect real-user variance instead of fighting it.
Artifact Behavior classifier and analysis report
Signals
- Mouse
- Keyboard
- Scroll
- Dwell
Use case Real-user vs. automation
Track 07 / 08 Layer VII
Application & API Shape
Watch endpoint order, GraphQL query shape, and error patterns. This is where automation reveals itself as a thing gaming the app rather than using it.
Artifact Application abuse playbook
Signals
- Endpoint order
- GraphQL shape
- Errors
Use case GraphQL and API abuse
Track 08 / 08 Layer VIII
Business Impact & Tradeoffs
Translate signals into the cost of fraud, scraping pressure, review-queue load, and the false-positive risk the brand will actually accept.
Artifact Risk, cost, and policy runbook
Signals
- Fraud
- Scraping
- Cost
- False positives
Use case Threshold and policy tuning
Sandboxes · BLS-03
Experiment before production does.
Controlled environments for testing detections, challenges, thresholds, and evasion hypotheses before they touch production traffic.
Sandbox 01 SBX-01
Traffic Simulation
Replay synthetic traffic cohorts to see how fingerprint, IP, timing, and session signals shape a verdict.
Focus
- Fingerprint coverage
- Headless signals
- Session shape
- Method
- Synthetic cohort replay
- Output
- Verdict trace
Sandbox 02 SBX-02
Challenge Testing
Insert challenges into controlled journeys and measure where useful evidence becomes real-user friction.
Focus
- Proof-of-work
- Behavioral checks
- Cognitive prompts
- Method
- Controlled journey insertion
- Output
- Friction vs evidence map
Sandbox 03 SBX-03
Detection Tuning
Tune thresholds against abuse pressure, false-positive cost, review volume, and operator confidence.
Focus
- Threshold sweep
- False-positive cost
- Review load
- Method
- Counterfactual replay
- Output
- Operating-point report
Sandbox 04 SBX-04
Evasion Review
Review spoofed profiles, replay traces, and coherence checks in a contained defensive environment.
Focus
- Spoofed profile
- Replay trace
- Signal coherence
- Method
- Adversarial walkthrough
- Output
- Coherence verdict