// per-site profile
what detects you on cleantalk.org
cleantalk.org is defended by recaptcha v2 / v3, which declares native challenge (3/3), strong behavioral (2/3), partial js fingerprint (1/3) capability. below: the layers it enforces and the tool config the matrix predicts survives it.
enforced detection layers
| detection layer | capability | what it covers |
|---|---|---|
| tls / network fingerprint | unaddressed | the ja3/ja4 clienthello and http/2 settings signature the edge reads before any javascript runs. |
| ip reputation | unaddressed | asn, proxy-class, and abuse-history scoring of the connecting address. |
| js fingerprint | 1/3 partial | canvas, webgl, navigator, font, and audio signals collected in-page. |
| behavioral | 2/3 strong | mouse, keyboard, and timing biometrics read from interaction cadence. |
| challenge | 3/3 native | interactive or invisible captcha and proof-of-work gates. |
| attestation | unaddressed | hardware or os-backed integrity checks (webauthn, play integrity, device attestation). |
| server coherence | unaddressed | cross-checking headers, tls, ip, and js for internal consistency. |
unaddressed means this tool type does not operate at that layer, so it is not a failing score. a red 0/3 is a real, declared score of zero. both are declared capability, not live pass-rates.
recommended config (matrix-predicted)
| enforced layer | argmax tool |
|---|---|
| js fingerprint | CloakBrowser (stealth Chromium) |
| behavioral | Camoufox (anti-detect Firefox) |
| challenge | nothing catalogued |
public-matrix prediction (argmax capability per layer), free. the benchmarked winning bundle for cleantalk.org, the one verified against a live run and kept fresh, is metered: see what a lookup costs.
notes
NOT SCORED. The rule is uncalibrated and its pattern reads BOILERPLATE (KAN-432 / PA-SCORE-07). It was authored `speculative` with a note saying the pattern MUST be calibrated before use, and shipped `scored: true` anyway: a public detectors-grid column and 510 leaderboard-denominator rows, 0 of them passing. VERIFIED LIVE 2026-07-29 (86 688-byte page, ~20 300 chars of body text): the page does NOT auto-run. Its static state reads `Last Score, Not Tested / Run the reCAPTCHA test to see your current score and risk level`, so the claim above that it 'auto-runs grecaptcha.execute on load' is FALSE and a passive collector never gets a score at all. Worse, every group in `scorePattern` after the capture is OPTIONAL, so the regex degenerates to 'the first bare 0/1-ish number anywhere in the text'; run against the live body it captures `0.9`, from the static legend `Guide: 0.9–1.0 low risk`, which satisfies `scoreGte: 0.5`. The rule is therefore a coin-flip between a guaranteed false PASS off marketing copy and a guaranteed fail, decided by whether the page renders, and neither outcome is a measurement. `scored` removed; the ledger's 510 rows should be treated as void. To revive it: drive the button, anchor the pattern to the labelled result element, then confirm. `expectedVendor` is deliberately `recaptcha-v2` and is NOT a bug, the field names the wire DETECTION FAMILY and the vendor roster has no `recaptcha-v3` slug; the sibling Google-demo target `recaptcha-v3` carries the same value.
questions
- what detects you on cleantalk.org?
- cleantalk.org is defended by recaptcha v2 / v3, which declares native challenge (3/3), strong behavioral (2/3), partial js fingerprint (1/3) capability.
- which config survives cleantalk.org?
- matrix-predicted per enforced layer: js fingerprint → CloakBrowser (stealth Chromium); behavioral → Camoufox (anti-detect Firefox). this is a public-matrix prediction, not a metered recipe.