This reconstruction verifies captured HTTP responses and client behavior within an explicit local model. It does not establish 100% knowledge of the remote system.
| Behavior | Evidence basis |
|---|---|
| Recorded HTTP bodies and response mismatch | 106 saved responses with SHA-256 checks; original statuses retained as metadata |
| Filtering on additional tested user-agent inputs | 59 controlled comparisons with stable controls, exact headers, hashes and token-boundary examples; private classifier source remains unknown |
| Profile to JavaScript wrapper to landing to destination | Continuous live HAR and local browser sequence |
| User-agent and referrer inputs to the client | Captured scripts executed in Chrome with explicit navigator inputs |
| Platform navigation methods | Captured client chooses URLs; local adapter records and contains navigation |
| Telemetry outcomes and error handling | Captured sendBeacon calls reach the local collector, with rejection/error models |
| Timers, idle hints and fallback instructions | Real DOM plus controlled browser clock |
| Pending attempt storage and return visits | Real localStorage plus captured lifecycle code |
| Touch, hold and secondary age confirmation | Captured handlers; unobserved server inputs are explicitly modeled |
| Our experimental network/device extension | Separately attributed logic: empty-User-Agent blanking, timezone/DST and UTC clock comparisons, IP intelligence inputs, verification routing and WebRTC candidate handling. These are our ideas, not original-site findings. |
| Our human-verification continuation | Local demo flow and mocked server-side Turnstile validation, including hostname/action/context binding, direct creator redirect, failures, timeout and replay/expiry rejection. Live Cloudflare integration requires keys. |