Bot Scanner Pro: Catch Evasive AI Browsers

AI agents are coming for your website. Not the clumsy Selenium scripts from 2018. We’re talking about Stagehand, Browserbase, and Playwright with stealth plugins—browsers built from the ground up to look human and evade detection.

Traditional bot detection is blind to them. We’re not.

Bot Scanner Pro is our enhanced detection script that catches AI browsers with 60-75% accuracy using behavioral analysis, deep fingerprinting, and two-phase detection. Most competitors catch less than 20%.

Let’s break down what we built, how it works, and why your current bot protection is probably useless against the new wave of AI agents.

The AI Browser Problem Nobody’s Talking About

Here’s the uncomfortable truth: Most bot detection was built for a different era.

Five years ago, headless browsers were obvious. They had missing APIs, detectable WebGL signatures, and predictable behavior. A few fingerprint checks caught 80% of bots.

That’s not the world we live in anymore.

The New Threat Landscape

Stagehand (by Browserbase) is an open-source framework specifically designed for AI agents to control browsers. It’s built to evade detection. The developers literally benchmark against bot detection tools.

Browserbase provides cloud-hosted browsers with residential proxies and anti-detection built in. They rotate fingerprints, simulate human behavior, and pass most bot checks.

Playwright with stealth plugins patches every known fingerprinting vector. Canvas, WebGL, audio context—all spoofed to look legitimate.

These aren’t script kiddies. These are production-grade tools used by AI companies, data brokers, and yes—attackers running credential stuffing at scale.

Your traditional bot detection catches maybe 10-40% of them. That’s not protection. That’s a participation trophy.

How Bot Scanner Pro Catches What Others Miss

Bot Scanner Pro uses a fundamentally different approach: behavioral analysis that can’t be spoofed combined with deep fingerprinting that catches software rendering.

1. Behavioral Analysis

Bots can fake fingerprints. They can’t fake being human.

We track every interaction on your page and analyze patterns that reveal automation:

Mouse Movement Analysis:

• Movement count: Real users generate 50-200+ mouse events in 5 seconds. Bots typically generate fewer than 10.
• Path linearity: Humans move in curved, natural paths. Bots move in straight lines.
• Velocity variation: Human mouse movement has natural acceleration and deceleration. Bots move at constant velocity.
• Grid alignment: Real cursor positions are random. Bots often land on exact pixel coordinates (100, 200, 300…).

Click Behavior:

• Pre-click movement: Humans move the mouse before clicking. Bots teleport and click instantly.
• Click timing: Real clicks have natural delays. Bot clicks are suspiciously fast or perfectly timed.

Scroll Patterns:

• Velocity variation: Human scrolling is irregular. Bot scrolling is mechanical.
• Momentum: Real scroll events have inertia. Bot scrolls stop abruptly.

Here’s what a Bot Scanner Pro detection payload looks like when we catch a Stagehand bot:

{
  "detection_source": "bot_scanner_pro",
  "behavioral_signals": {
    "mouse": {
      "movement_count": 7,
      "linear_path_ratio": 0.89,
      "velocity_variance": 0.02,
      "grid_aligned_ratio": 0.71
    },
    "clicks": {
      "instant_click_ratio": 1.0,
      "no_pre_movement": true
    },
    "scroll": {
      "constant_velocity": true,
      "no_momentum": true
    }
  },
  "behavioral_score_adjustments": {
    "low_mousemove_count": 25,
    "linear_paths": 20,
    "constant_velocity": 15,
    "grid_aligned": 15,
    "instant_clicks": 30,
    "no_pre_movement": 25
  },
  "threat_score": 92,
  "verdict": "block"
}

That’s 130 points of bot signals from behavior alone. No fingerprint checks needed.

2. WebGL Deep Fingerprinting

Stealth browsers spoof basic WebGL values. They don’t spoof everything.

Bot Scanner Pro extracts:

• RENDERER and VENDOR strings
• UNMASKED_RENDERER_WEBGL and UNMASKED_VENDOR_WEBGL
• Supported WebGL extensions list
• Shader precision formats

Here’s what we catch:

Real browsers on real hardware have real GPUs. Headless browsers run on servers with software rendering. We catch the difference.

{
  "webgl_fingerprint": {
    "renderer": "ANGLE (Intel, Mesa Intel(R) UHD Graphics 620, OpenGL 4.6)",
    "vendor": "Google Inc. (Intel)",
    "unmasked_renderer": "Mesa Intel(R) UHD Graphics 620",
    "extensions_count": 37,
    "signals": []
  }
}

vs.

{
  "webgl_fingerprint": {
    "renderer": "Google SwiftShader",
    "vendor": "Google Inc.",
    "unmasked_renderer": null,
    "extensions_count": 24,
    "signals": ["swiftshader_renderer", "no_unmasked_renderer"]
  }
}

The second one is headless Chrome. Caught.

3. Canvas Fingerprinting

Every GPU renders slightly differently. Bot Scanner Pro draws shapes, text, and gradients to a hidden canvas and generates a unique hash.

The catch? Software rendering produces different hashes than hardware rendering. And stealth plugins that try to randomize canvas output produce inconsistent hashes across requests—which is itself a detection signal.

4. Audio Context Fingerprinting

This one catches even sophisticated stealth setups.

We create an OscillatorNode, run it through audio processing, and generate a fingerprint from the output. We also check baseLatency—a property that headless browsers often fail to implement correctly.

{
  "audio_fingerprint": {
    "fingerprint_hash": "a7b3c9d2e1f4...",
    "base_latency": 0.01,
    "signals": []
  }
}

vs.

{
  "audio_fingerprint": {
    "fingerprint_hash": "0000000000000000",
    "base_latency": null,
    "signals": ["zero_audio_fingerprint", "missing_base_latency"]
  }
}

Zero audio fingerprint = no audio hardware = headless browser. +35 points.

5. Two-Phase Detection

Here’s where Bot Scanner Pro gets clever.

Phase 1 (Immediate): On page load, we run all fingerprint checks and send initial signals to the API. This catches obvious bots instantly.

Phase 2 (5 seconds later): We collect behavioral data—mouse movements, clicks, scrolls, keystrokes—and send an update. This catches bots that pass fingerprint checks but fail behavioral analysis.

Why two phases? Because sophisticated bots can spoof static fingerprints. They can’t fake 5 seconds of human behavior.

{
  "detection_phase": "behavioral_update",
  "time_on_page": 5.2,
  "behavioral_data": {
    "mouse_events": 4,
    "click_events": 1,
    "scroll_events": 0,
    "keystroke_events": 0
  },
  "threat_score_delta": 45,
  "final_threat_score": 87,
  "verdict": "challenge"
}

Detection Rate Comparison: Lite vs. Pro

Here’s the data that matters. We tested both scripts against common AI browser configurations:

Bot Scanner Pro catches 3x more Stagehand bots than our Lite version. And our Lite version already beats most competitors.

Against Playwright with stealth plugins—the most common automation framework—we hit 75% detection. That’s not 100%, but it’s dramatically better than the 40% you’re getting from fingerprint-only solutions.

Implementation: One Script Tag

Bot Scanner Pro is the same simple deployment as our Lite version:

<script
  src="https://cdn.webdecoy.io/pro.js"
  data-account="acc_your_id"
  data-scanner="scn_scanner_id"
  async
></script>

That’s it. 16KB of JavaScript that runs silently, collects signals, and reports to our API.

The script is:

• Non-blocking: Loads asynchronously, doesn’t slow your page
• Privacy-conscious: No PII collection, GDPR compliant
• Lightweight: 16KB minified (only 4KB more than Lite)

What Happens When We Detect a Bot

Every detection hits your webhook in real-time:

{
  "event": "detection",
  "detection_id": "det_a7b3c9d2e1f4",
  "timestamp": "2025-12-03T14:23:45Z",
  "visitor": {
    "ip": "192.0.2.1",
    "user_agent": "Mozilla/5.0...",
    "session_id": "sess_x9y8z7"
  },
  "analysis": {
    "threat_score": 87,
    "verdict": "block",
    "signals": [
      "low_mousemove_count",
      "linear_paths",
      "instant_clicks",
      "swiftshader_renderer"
    ],
    "detection_phase": "behavioral_update"
  },
  "recommended_action": "block"
}

You decide what to do: block, challenge with CAPTCHA, rate limit, or flag for review. We give you the signals. You set the policy.

Why Competitors Can’t Keep Up

Most bot detection vendors are running the same playbook from 2019:

• Check navigator.webdriver
• Run basic canvas fingerprint
• Look for headless user agents
• Maybe check a few more APIs

That’s 5 minutes of work for a stealth plugin to bypass.

Stagehand, Browserbase, and Playwright stealth exist specifically because that approach doesn’t work anymore. The developers of these tools actively test against bot detection. Every fingerprint check you can think of, they’ve already patched.

Bot Scanner Pro wins because we’re not playing the fingerprint game. We’re analyzing behavior—and behavior is hard to fake at scale.

An AI agent can spoof a canvas hash. It can’t generate 200 natural mouse movements with realistic velocity curves while completing its task in under 5 seconds. The economics don’t work.

Pricing: Enterprise Detection, Startup Pricing

Bot Scanner Pro is included in our Pro plan at $149/month with:

• 100,000 detections/month
• Full behavioral analysis
• WebGL/Canvas/Audio fingerprinting
• Two-phase detection
• Real-time webhooks
• Dashboard analytics

That’s $0.0015 per detection for the most advanced AI browser detection on the market.

Compare that to enterprise bot management solutions charging $50,000+/year for worse detection rates against modern threats.

Stop Getting Scraped by AI Agents

AI browsers aren’t going away. Stagehand has 10,000+ GitHub stars. Browserbase is backed by serious VC money. Every week, a new AI startup launches that needs to scrape the web.

Your options:

1. Do nothing and watch your content get harvested, your APIs get abused, and your infrastructure costs spike
2. Use traditional bot detection and catch maybe 20% of AI agents
3. Deploy Bot Scanner Pro and actually protect your site

We built Bot Scanner Pro because the old approaches don’t work anymore. Behavioral analysis and deep fingerprinting aren’t optional—they’re the minimum viable defense against modern AI browsers.

Get Started Now

Start your free trial and deploy Bot Scanner Pro in under 5 minutes. See the difference in your detection rates immediately.

Have questions about catching specific AI browsers? Read our documentation or contact us directly.

Ready to catch the AI browsers your current solution misses?

Try WebDecoy Free | View Pricing | Read the Docs