About Fingerprint Scan
I'm Antoine Vastel, a security researcher working on browser fingerprinting, bot detection, and fraud detection.
I created Fingerprint Scan as a personal playground to experiment with browsers, bots, proxies, automation frameworks, and fingerprinting techniques. I use it to send different kinds of traffic, compare fingerprints, test spoofing, try new signals, and see how automated or unusual browser setups behave.
At some point I decided to make it public. The goal is simple: show some of the signals that websites and anti-bot systems can observe, and make them easier to inspect.
What the test looks at
Fingerprint Scan collects signals related to:
- browser and operating system information;
- device and screen properties;
- JavaScript and browser APIs;
- Canvas, WebGL, and GPU information;
- WebRTC;
- HTTP and network properties;
- media and DRM capabilities;
- automation and headless browser indicators;
- inconsistencies between related signals.
For bot detection, the interesting part is often not whether a fingerprint is unique, but whether the different signals make sense together. A browser may claim to run on one platform while exposing properties from another. An automation framework may spoof a value in one context and forget to change it in an iframe or a Web Worker. Those inconsistencies are useful detection signals.
Experimental signals
Fingerprint Scan is also where I test new ideas. Some experimental signals are collected but not shown in the UI. I only expose a signal publicly once I've tested it enough and can explain what it means and why it's useful. I want the visible part of the scanner to stay understandable, not a dump of hundreds of obscure properties.
About the bot score
The bot score is intentionally simple. It combines a limited set of browser, automation, network, and consistency checks.
Some legitimate users, especially those using privacy tools, hardened browsers, extensions, VMs, proxies, or unusual setups, may trigger false positives. If that happens, ping me. I'm interested in these cases and will try to adjust the rules when I can.
Real-world bot detection is much more complex. Production systems usually combine browser fingerprints with network reputation, historical behavior, traffic patterns, session context, account activity, and a lot of other server-side signals. Fingerprint Scan is a simplified playground for some of those ideas.
About me
I'm Antoine Vastel. I started researching browser fingerprinting during my PhD in computer science and have been working on fingerprinting and bot detection for about ten years.
I spent five years at DataDome on device fingerprinting, behavioral analysis, proxy detection, and bot detection. I now work at Castle, where I lead research on bot, fraud, and abuse detection.
Fingerprint Scan is a personal research project. The experiments, detection rules, implementation, and opinions here are my own and are separate from my work at Castle. The techniques shown here are also simpler than what production anti-bot systems use.
More of my research and projects are on antoinevastel.com.
Why make it public?
Because this kind of experimentation is more useful when people can inspect it themselves. You can open the site in different browsers, run it through automation, switch proxies, enable privacy tools, spoof properties, and see what changes. That's essentially what I use it for too.