is-antibot 1.6.1 → 1.7.0

package/README.md

@@ -15,6 +15,7 @@
 
 - **CloudFlare** - Bot management and challenge pages
 - **Vercel** - Attack mode protection
+- **Anubis** - Techaro BotStopper proof-of-work challenge
 - **Akamai** - Bot Manager and Web Application Protector
 - **DataDome** - Bot protection with CAPTCHA challenges
 - **PerimeterX** - Behavioral bot detection
@@ -28,6 +29,7 @@
 - **ThreatMetrix** - LexisNexis fraud prevention and device fingerprinting
 - **Meetrics** - User authenticity verification
 - **Ocule** - Bot detection with advanced obfuscation
+- **Instagram** - Login page redirect bot detection
 - **YouTube** - BotGuard attestation and abuse detection
 - **LinkedIn** - Bot filter protection
 - **Reddit** - Network security challenge-page detection

package/package.json

@@ -2,7 +2,7 @@
   "name": "is-antibot",
   "description": "Identify if a response is an antibot challenge from CloudFlare, Akamai, DataDome, Vercel, PerimeterX, Shape Security, and more, including CAPTCHA providers like reCAPTCHA and hCaptcha.",
   "homepage": "https://github.com/microlinkhq/is-antibot",
-  "version": "1.6.1",
+  "version": "1.7.0",
   "exports": {
     ".": "./src/index.js"
   },
@@ -31,6 +31,7 @@
   "keywords": [
     "akamai",
     "antibot",
+    "anubis",
     "arkose",
     "aws-waf",
     "bot",

package/src/index.js

@@ -385,12 +385,13 @@ const detect = ({ headers = {}, html = '', url = '', statusCode } = {}) => {
   }
 
   // Reddit: blocked requests are served as HTML challenge pages.
-  // Strongest signal is the blocked-page copy in HTML.
-  if (
-    parseUrl(url).domain === 'reddit.com' &&
-    hasAnyHtml([/blocked by network security\./i])
-  ) {
-    return byHtml('reddit')
+  if (parseUrl(url).domain === 'reddit.com') {
+    if (statusCode === 403) {
+      return byStatusCode('reddit')
+    }
+    if (hasAnyHtml([/blocked by network security\./i])) {
+      return byHtml('reddit')
+    }
   }
 
   // LinkedIn: status 999 is LinkedIn's dedicated bot-detection response
@@ -412,6 +413,19 @@ const detect = ({ headers = {}, html = '', url = '', statusCode } = {}) => {
     return byHtml('youtube')
   }
 
+  // Anubis (Techaro BotStopper): challenge pages always contain the JSON script block
+  // `<script id="anubis_challenge" type="application/json">` (hardcoded in web/index.templ)
+  // and asset/API URLs under the Go constant `StaticPath = "/.within.website/x/cmd/anubis/"`.
+  // Source: https://github.com/TecharoHQ/anubis
+  if (
+    hasAnyHtml([
+      /<script id="anubis_challenge"/,
+      '/.within.website/x/cmd/anubis/'
+    ])
+  ) {
+    return byHtml('anubis')
+  }
+
   // AWS WAF: Check for x-amzn-waf-action or x-amzn-requestid headers
   // Reference: https://github.com/scrapfly/Antibot-Detector/blob/main/detectors/antibot/detect-aws-waf.json
   if (hasAnyHeader(['x-amzn-waf-action', 'x-amzn-requestid'])) {