Skip to content

Antibot Detection
PRO

Know exactly who blocked your request and why. Microlink detects antibot and CAPTCHA challenges from 30+ providers using response signals — then you can decide what to do next.

Why

When a request fails, know who stopped it.

Microlink handles +700M requests every month. When you build infrastructure that takes a URL as input, you are constantly interacting with defenses designed to stop you.

A request can experience

Followed by a challenge page. A captcha. A JavaScript puzzle.

Modern antibot systems operate at multiple layers, often before your request even reaches application code. Detection does something fundamental: it tells you when a non-success resolution happens and who triggered it, so you can make a better decision about what to do next.
Illustrative distribution of blocked antibot providersblockedprovidersrecaptchacloudflarecloudflare-turnstileaws-wafakamaihcaptcha
Common signals include:
  • IP reputation: Data-center IPs are flagged by default. Residential traffic behaves differently.
  • HTTP consistency: Headers must match a real browser profile — not just User-Agent, but the full set.
  • TLS fingerprints (JA3): The way a client negotiates TLS leaks whether it is a browser or a script.
  • Behavioral heuristics: Timing, navigation order, and interaction patterns matter.
  • JavaScript fingerprinting: Canvas, WebGL, fonts, screen size — small inconsistencies are enough.
Based on these signals, a request is either:
  • Allowed: Heuristics indicate a legitimate visitor — the request passes through to the target.
  • Blocked: The request looks highly suspicious and is refused immediately with 403 or 429.
  • Challenged: The system is unsure and serves a CAPTCHA or JavaScript interstitial before content.
How it works

Classify the challenge. Name the provider.

At a high level, Microlink classifies challenge responses using the HTTP response itself — no headless browser required for detection. Each provider leaves a distinct combination of signals. Providers are checked in priority order; the first match wins.
  • HTTP status patterns — LinkedIn can return 999; Reddit can return 403 on challenge flows
  • Known challenge signatures — CAPTCHA widgets, interstitial templates, verification scripts
  • Response headers and body markers — mitigation headers, challenge tokens, provider script references
  • Provider-specific fingerprints — for example Cloudflare commonly surfaces cf-mitigated: challenge
Providers

30+ providers across antibot, CAPTCHA, and platforms.

Use this coverage map when building retry logic, escalation rules, or provider-specific analytics in your scraping pipeline.
  • Akamai
    Antibot · 3 signals
    HeadersCookiesHTML
  • AliExpress CAPTCHA
    CAPTCHA · 2 signals
    HTMLURL
  • Amazon
    Platform-specific · 2 signals
    HeadersHTML
  • Anubis
    Antibot · 1 signal
    HTML
  • AWS WAF
    Antibot · 3 signals
    HeadersCookiesHTML
  • Captcha.eu
    CAPTCHA · 2 signals
    HTMLURL
  • Cheq
    Antibot · 2 signals
    HTMLURL
  • Cloudflare
    Antibot · 2 signals
    HeadersCookies
  • Cloudflare Turnstile
    CAPTCHA · 2 signals
    HTMLURL
  • DataDome
    Antibot · 2 signals
    HeadersCookies
  • Douban
    Platform-specific · 1 signal
    Status Code
  • Dribbble
    Platform-specific · 1 signal
    Status Code
  • Friendly Captcha
    CAPTCHA · 2 signals
    HTMLURL
  • FullStory Challenge
    Antibot · 2 signals
    CookiesHTML
  • FunCaptcha (Arkose Labs)
    CAPTCHA · 2 signals
    HTMLURL
  • GeeTest
    CAPTCHA · 2 signals
    HTMLURL
  • Google
    Platform-specific · 1 signal
    URL
  • hCaptcha
    CAPTCHA · 2 signals
    HTMLURL
  • Houzz
    Platform-specific · 1 signal
    Status Code
  • Imperva / Incapsula
    Antibot · 3 signals
    HeadersCookiesHTML
  • Instagram
    Platform-specific · 1 signal
    HTML
  • Kasada
    Antibot · 2 signals
    HeadersHTML
  • LinkedIn
    Platform-specific · 1 signal
    Status Code
  • Meetrics
    Antibot · 2 signals
    HTMLURL
  • Ocule
    Antibot · 2 signals
    HTMLURL
  • PerimeterX
    Antibot · 3 signals
    HeadersCookiesHTML
  • QCloud Captcha
    CAPTCHA · 2 signals
    HTMLURL
  • Reblaze
    Antibot · 2 signals
    CookiesHTML
  • reCAPTCHA
    CAPTCHA · 2 signals
    HTMLURL
  • Reddit
    Platform-specific · 2 signals
    HTMLStatus Code
  • Shape Security
    Antibot · 2 signals
    HeadersHTML
  • Sucuri
    Antibot · 1 signal
    HTML
  • ThreatMetrix
    Antibot · 2 signals
    HTMLURL
  • Vercel
    Antibot · 1 signal
    Headers
  • Weibo
    Platform-specific · 1 signal
    HTML
  • YouTube
    Platform-specific · 1 signal
    HTML
ProviderCategorySignalsDetection methods
AkamaiAntibot3
HeadersCookiesHTML
AliExpress CAPTCHACAPTCHA2
HTMLURL
AmazonPlatform-specific2
HeadersHTML
AnubisAntibot1
HTML
AWS WAFAntibot3
HeadersCookiesHTML
Captcha.euCAPTCHA2
HTMLURL
CheqAntibot2
HTMLURL
CloudflareAntibot2
HeadersCookies
Cloudflare TurnstileCAPTCHA2
HTMLURL
DataDomeAntibot2
HeadersCookies
DoubanPlatform-specific1
Status Code
DribbblePlatform-specific1
Status Code
Friendly CaptchaCAPTCHA2
HTMLURL
FullStory ChallengeAntibot2
CookiesHTML
FunCaptcha (Arkose Labs)CAPTCHA2
HTMLURL
GeeTestCAPTCHA2
HTMLURL
GooglePlatform-specific1
URL
hCaptchaCAPTCHA2
HTMLURL
HouzzPlatform-specific1
Status Code
Imperva / IncapsulaAntibot3
HeadersCookiesHTML
InstagramPlatform-specific1
HTML
KasadaAntibot2
HeadersHTML
LinkedInPlatform-specific1
Status Code
MeetricsAntibot2
HTMLURL
OculeAntibot2
HTMLURL
PerimeterXAntibot3
HeadersCookiesHTML
QCloud CaptchaCAPTCHA2
HTMLURL
ReblazeAntibot2
CookiesHTML
reCAPTCHACAPTCHA2
HTMLURL
RedditPlatform-specific2
HTMLStatus Code
Shape SecurityAntibot2
HeadersHTML
SucuriAntibot1
HTML
ThreatMetrixAntibot2
HTMLURL
VercelAntibot1
Headers
WeiboPlatform-specific1
HTML
YouTubePlatform-specific1
HTML
Related features

From detection to access.

Proxy Resolution

PRO
Automatically bypass Cloudflare, DataDome, Akamai and more. We handle the hard part.

Custom HTTP Headers

PRO
Forward cookies, tokens and any header to the target page. Keep secrets out of the URL.

Web Scraping

Extract structured JSON from any webpage using CSS selectors. URL → JSON in one request.

Browser Functions

Run JavaScript with Puppeteer and npm packages. No infrastructure, no servers.

FAQ

What does antibot detection tell me?

Whether a response is an antibot or CAPTCHA challenge, which of 30+ providers triggered it, and which signal matched — so you can choose the right next step instead of treating every failure the same.

Why does naming the provider matter?

Antibot systems are not interchangeable. A Cloudflare JS challenge is not an Akamai edge block. Once you know who blocked you, you can adapt retries, route through a proxy, escalate to a browser, or exit early.

How do I resolve a detected block?

On Pro, retry with
proxy: true
. Microlink routes through residential IPs for the named provider, then returns the normal result.

Is the detection logic open source?

Yes. The classifier is published as
is-antibot
so you can audit how providers and signals are matched.