If you loaded this page normally, something already happened before you saw it: you were fingerprinted. Your TLS handshake was inspected for a JA3/JA4 fingerprint, your request headers were analyzed, and (if your JavaScript ran) a few of those signals were collected too. All of that fed into a live classification, visible on the dashboard page. I'm attempting to determine whether you're a human, a disclosed AI agent, a scripted bot, or something in between.
That's the premise of this blog. Bot detection is getting harder at exactly the moment it matters the most. AI browsing agents now run inside real browsers, on clean residential IPs, executing JavaScript and producing signals that appear to be human. The signals we've relied on for over the last decade that we used to use to separate "bot" from "human" are quietly breaking down. Meanwhile, some agents self-identify in their User-Agent (GPTBot, ChatGPT-User, PerplexityBot), and others don't, which is arguably the more interesting case.
On a personal note, I took a sabbatical from work and bot detection just about a year ago. I miss it. So, rather than just write about this in the abstract, I'm working on this tool to get my fix. Who knows, maybe it will be beneficial to someone in the long run. On the techincal side, this site terminates its own TLS connection specifically so it can see the raw ClientHello before any HTTP request exists, runs a small classifier against every visit, and shows its reasoning. I'm attempting to not just a use a label; insatead, on the dashboard you'll get an explanation as to why the request was classified the way it was. Nothing here is aggregated into a profile of you personally, there are no accounts, and nothing is tracked across sites. I respect privacy. It's a research instrument for traffic patterns, not a surveillance layer pointed at people.
More posts will follow as I run more experiments anmd write some more. My goals are to analyze recompiled Chrome browsers, Agent requests, Playwright, and how new, real browsers and their signals look. I'm interested in what happens when a disclosed AI agent visits versus one that doesn't announce itself. Traditional approaches have typically broken down when privacy-conscious humans with JS disabled trip some of the same wires bots do. That tension, that false-positive, is worth taking seriously rather than glossing over. For now: go take a look at the dashboard, then come back and refresh this page a few times. You should see your own visits show up. 🤞
Live and Drink, knowledge-seeker