// per-site profile
what detects you on scrapingcourse.com
scrapingcourse.com is defended by cloudflare bot management, which declares native tls / network fingerprint (3/3), native server coherence (3/3), strong ip reputation (2/3), strong js fingerprint (2/3), strong behavioral (2/3), strong challenge (2/3) capability. below: the layers it enforces and the tool config the matrix predicts survives it.
enforced detection layers
| detection layer | capability | what it covers |
|---|---|---|
| tls / network fingerprint | 3/3 native | the ja3/ja4 clienthello and http/2 settings signature the edge reads before any javascript runs. |
| ip reputation | 2/3 strong | asn, proxy-class, and abuse-history scoring of the connecting address. |
| js fingerprint | 2/3 strong | canvas, webgl, navigator, font, and audio signals collected in-page. |
| behavioral | 2/3 strong | mouse, keyboard, and timing biometrics read from interaction cadence. |
| challenge | 2/3 strong | interactive or invisible captcha and proof-of-work gates. |
| attestation | unaddressed | hardware or os-backed integrity checks (webauthn, play integrity, device attestation). |
| server coherence | 3/3 native | cross-checking headers, tls, ip, and js for internal consistency. |
unaddressed means this tool type does not operate at that layer, so it is not a failing score. a red 0/3 is a real, declared score of zero. both are declared capability, not live pass-rates.
recommended config (matrix-predicted)
| enforced layer | argmax tool |
|---|---|
| tls / network fingerprint | curl_cffi (transport baseline) |
| ip reputation | nothing catalogued |
| js fingerprint | CloakBrowser (stealth Chromium) |
| behavioral | Camoufox (anti-detect Firefox) |
| challenge | nothing catalogued |
| server coherence | nothing catalogued |
public-matrix prediction (argmax capability per layer), free. the benchmarked winning bundle for scrapingcourse.com, the one verified against a live run and kept fresh, is metered: see what a lookup costs.
notes
Cloudflare managed-challenge test page (ScrapingCourse, a purpose-built scraping sandbox). VERIFIED live: a non-browser / automated client gets HTTP 403 + 'Server: cloudflare' + 'cf-mitigated: challenge' and a 'Just a moment…' interstitial body; a browser that clears the managed challenge gets the real course content (no 'Just a moment'). human = no challenge interstitial. Replaces the former cloudflare.com marketing-site placeholder, which served everyone and could not discriminate (KAN-165). The definitive verdict is TLS/H2 + cf_clearance server-side; the interstitial-text check is the DOM-readable proxy for it. nowsecure.nl was rejected as an alternative. It now returns 200 with success content to plain curl (invisible challenge), so status can't distinguish block from serve.
questions
- what detects you on scrapingcourse.com?
- scrapingcourse.com is defended by cloudflare bot management, which declares native tls / network fingerprint (3/3), native server coherence (3/3), strong ip reputation (2/3), strong js fingerprint (2/3), strong behavioral (2/3), strong challenge (2/3) capability.
- which config survives scrapingcourse.com?
- matrix-predicted per enforced layer: tls / network fingerprint → curl_cffi (transport baseline); js fingerprint → CloakBrowser (stealth Chromium); behavioral → Camoufox (anti-detect Firefox). this is a public-matrix prediction, not a metered recipe.