Puppeteer, Playwright, and antidetect browsers run real Chrome. AI agents complete checkouts on your site right now. TRACIO catches them all at the JavaScript runtime — before they extract a single row.
Automation frameworks and headless browsers leave fingerprints in the JavaScript runtime, network stack, and rendering pipeline. TRACIO reads them all.
TRACIO inspects the JavaScript runtime, DOM API, and rendering pipeline for automation artifacts. Headless mode, Puppeteer, Playwright, and Selenium leave traces.
Network-layer signals reveal automation frameworks even before JavaScript runs. JA3 and HTTP/2 fingerprints expose Python requests, Go clients, and headless browser libraries.
Scraper farms often distribute requests across many IPs but share underlying device profiles. Cross-request correlation surfaces the underlying farm structure.
Confirmed scrapers are blocked, served decoy content, or throttled to make extraction uneconomical. Real users continue with zero added friction.
Bot traffic now exceeds human traffic on most websites. AI agent traffic alone grew 7,851% in 2025. Scraper operators have moved beyond simple HTTP clients — they now run real browsers (Chrome, Firefox, Safari) automated by Puppeteer and Playwright, indistinguishable from human users at the network layer.
robots.txt is voluntary. Rate limits trigger only after the scraper has already extracted significant data, and aggressive limits hurt real users. CAPTCHAs add friction for everyone while solver services defeat them at scale for $1 per 1,000.
The signal that exposes modern scrapers is not behavior or IP — it is the device itself. Headless browsers, automation frameworks, and DevTools usage leave artifacts in the JavaScript runtime that real user sessions never produce. TRACIO catches them all.
Each technique exploits a different layer of the web stack. TRACIO covers them all with hardware-level signals.
Puppeteer and Playwright in headless mode are the workhorses of modern scraping. TRACIO detects headless artifacts even when stealth plugins try to hide them.
Anti-detect tools spoof browser fingerprints per session to scrape behind unique identities. Hardware-level signals see through the spoofing.
Scrapers route requests through 50K+ residential IPs to evade IP-based blocks. Device-level identification works regardless of IP rotation.
GPT-4 and Claude-powered agents now navigate websites autonomously. TRACIO classifies AI agent traffic separately from human users with high precision.
Results based on industry benchmarks and published research.
scraping traffic blocked or deflected
Imperva 2025 Bad Bot Report
reduction in bot-driven infrastructure cost
Akamai State of the Internet, 2024
of bot attacks use residential proxies (captured)
Imperva 2025 Bad Bot Report
Results vary by industry, content value, and existing security stack. Figures represent ranges observed across published research and are not guarantees.
AI agent traffic exploded in 2025. The internet is no longer just for humans — agents now complete checkouts, manage accounts, and navigate authenticated sessions.
HUMAN Security, 2026 State of AI Traffic Report
Detect Selenium, Puppeteer, Playwright, headless Chrome, Python requests, and custom automation frameworks. Real-time classification at the edge.
Network-layer signals (JA3, HTTP/2) expose automation frameworks before JavaScript even runs. Catch scrapers that disable JS entirely.
Identify when DevTools is open or being used to inspect page structure. A strong signal of scraping reconnaissance and reverse engineering.
Link related requests across IP addresses to identify distributed scraper farms. Surface the underlying operation behind seemingly random traffic.
Distinguish AI agent traffic (GPT, Claude, custom LLM agents) from human users. Allow, throttle, or block based on your monetization strategy.
Block scraper traffic at the edge so origin servers stop paying for bot load. Lower bandwidth bills and faster response times for real users.
A few lines of code, one API response with everything you need.
import { Tracio } from '@tracio/sdk'// Initialize on every page loadconst tracio = Tracio.init({ publicKey: "5ca175fc..." })// Read the identification resultconst result = await tracio.getResult()// Block scrapers at the edge (verified search engines are allowlisted automatically)if (result.bot.detected) { return new Response("Forbidden", { status: 403 })}// Continue serving real users normallyRelated products
Free plan, 2,500 API calls a month. Deploy in an afternoon, see the first blocked scrapers within a day.