captchaforge 0.2.36

# Community-contributed captcha provider rules.
#
# Each [[provider]] entry adds a TOML-driven detector to the registry.
# See `captchaforge::detect::rules` for the full schema. Detection is
# OR across triggers; first match wins.
#
# Priority guidance — interleave with built-ins:
#     5    challenge_page (CF interstitial — built-in)
#    10    turnstile (built-in)
#    11–19 reserved for vendor-specific overrides
#    20    recaptcha (built-in)
#    30    hcaptcha (built-in)
#    40    image_captcha (built-in)
#    50    audio_captcha (built-in)
#    60    pow_captcha (built-in)
#    65    canvas_captcha (built-in)
#    75    slider_captcha (built-in)
#    85    multi_step (built-in)
#    90    shadow_dom (built-in)
#    100+  catch-alls / community vendors
#
# When you ship a new provider, give it a priority that runs BEFORE the
# generic detector that would otherwise catch it (e.g. Geetest v4 must
# precede the generic slider_captcha at 75).

[[provider]]
name = "datadome"
priority = 11

[provider.triggers]
selectors = ["[data-datadome]", ".datadome-captcha", "iframe[src*='captcha-delivery.com']"]
window_globals = ["DataDomeOptions", "ddjskey"]
script_src_contains = ["js.datadome.co", "captcha-delivery.com"]
cookie_names = ["datadome", "_dd_s"]


[[provider]]
name = "akamai_bot_manager"
priority = 12

[provider.triggers]
selectors = ["[data-akamai-bot]", "iframe[src*='akamaihd.net/captcha']"]
window_globals = ["bmak", "_abck"]
script_src_contains = ["akamaihd.net/captcha", "akam.net/captcha", "akamaiedge.net"]
cookie_names = ["_abck", "bm_sz", "ak_bmsc"]


[[provider]]
name = "perimeterx_human"
priority = 13

# PerimeterX rebranded to HUMAN Security; both old and new signatures
# are kept here so the rule covers fleet that hasn't migrated.
[provider.triggers]
selectors = ["#px-captcha", ".px-captcha-error-container", "[data-px-captcha]"]
window_globals = ["_pxAppId", "PX", "_humanSecurity"]
script_src_contains = ["client.px-cdn.net", "captcha.px-cdn.net", "human-security.com/captcha"]
cookie_names = ["_px2", "_pxhd", "_px3", "_pxvid"]


[[provider]]
name = "arkose_funcaptcha"
priority = 14

# Arkose Labs (formerly FunCaptcha) — gamified rotation/orientation
# challenges. Detection signatures cover both branding eras.
[provider.triggers]
selectors = ["[data-pkey]", "#funcaptcha", ".arkose-iframe", "iframe[src*='arkoselabs.com']"]
window_globals = ["ArkoseEnforcement", "FunCaptcha"]
script_src_contains = ["client-api.arkoselabs.com", "funcaptcha.com"]


[[provider]]
name = "geetest_v4"
priority = 15

# Geetest v4 — slider/click puzzle. Must run BEFORE the generic
# slider_captcha (priority 75), otherwise the generic detector wins.
[provider.triggers]
selectors = [".geetest_box", ".geetest_panel", "[data-gt]"]
window_globals = ["initGeetest4", "Geetest"]
script_src_contains = ["static.geetest.com/v4", "static.geetest.com/static/js/gt4"]


[[provider]]
name = "geetest_v3"
priority = 16

# Geetest v3 (legacy slider). Distinct selectors from v4 so they
# don't false-match each other.
[provider.triggers]
selectors = [".geetest_holder", ".geetest_radar_btn", ".geetest_slider_button"]
window_globals = ["initGeetest"]
script_src_contains = ["static.geetest.com/static/tools/api.js", "geetest.com/v3"]


[[provider]]
name = "aws_waf_captcha"
priority = 17

# AWS WAF Captcha — visible visual challenge issued by AWS WAF
# protections. Distinct from the AWS Bot Control silent challenge,
# which has no captcha widget to solve.
[provider.triggers]
selectors = ["#captcha-container", "[data-aws-waf-captcha]", "iframe[src*='captcha.awswaf.com']"]
window_globals = ["AwsWafIntegration", "AwsWafCaptcha"]
script_src_contains = ["captcha.awswaf.com", "captcha-prod.awswaf.com"]


[[provider]]
name = "friendly_captcha"
priority = 18

# Friendly Captcha — privacy-preserving PoW. Distinct from generic
# pow_captcha (priority 60) so per-vendor routing is possible.
[provider.triggers]
selectors = [".frc-captcha", "[data-sitekey][data-puzzle-endpoint]"]
script_src_contains = ["cdn.jsdelivr.net/npm/friendly-challenge", "friendlycaptcha.com"]


[[provider]]
name = "mtcaptcha"
priority = 19

# MTCaptcha — accessibility-focused visual + audio captcha.
[provider.triggers]
selectors = [".mtcaptcha-container", "#mtcaptcha", ".mtcaptcha-widget"]
window_globals = ["mtcaptcha", "mtcaptchaConfig"]
script_src_contains = ["service.mtcaptcha.com", "service2.mtcaptcha.com"]


[[provider]]
name = "wp_math_captcha"
priority = 100

# Generic WordPress math captcha — common on contact forms.
# Runs LATE so per-vendor detectors win when both match.
[provider.triggers]
selectors = [
    "input[name='captcha-result']",
    "input[name='math_captcha']",
    "input[id*='math_captcha']",
    ".math-captcha-question",
    ".cptch_input",   # Captcha by BestWebSoft plugin
]


[[provider]]
name = "imperva_incapsula"
priority = 21
solver_names = ["CloudflareInterstitialSolver", "ThirdPartyCaptchaSolver"]

# Imperva (formerly Incapsula) bot challenge interstitial. Sets the
# `incap_ses_*` and `visid_incap_*` cookies after a JS challenge.
# Fronts many enterprise sites; routes through CloudflareInterstitialSolver
# pattern (passive wait + cookie capture).
[provider.triggers]
selectors = ["iframe[src*='_Incapsula_Resource']", "[id*='incapsula']"]
window_globals = ["_Incapsula_Resource", "incap_ses"]
script_src_contains = ["incapsula.com", "_Incapsula_Resource"]
cookie_names = ["visid_incap", "incap_ses"]


[[provider]]
name = "kasada"
priority = 22
solver_names = ["WaitForTokenSolver", "CloudflareInterstitialSolver", "ThirdPartyCaptchaSolver"]

# Kasada bot defense — issues x-kpsdk-ct token via challenge JS.
# Production sites: Twitter (X), Canada Goose, Hotels.com, others.
# Passive challenge; with stealth + warmup the JS challenge passes
# and we harvest the resulting cookies.
[provider.triggers]
selectors = ["script[src*='/ips.js']", "[id*='kpsdk']"]
window_globals = ["KPSDK"]
script_src_contains = ["client.px-cloud.net", "/ips.js"]
cookie_names = ["KP_UIDz", "x-kpsdk-cd", "x-kpsdk-ct"]


[[provider]]
name = "f5_distributed_cloud"
priority = 23
solver_names = ["CloudflareInterstitialSolver", "ThirdPartyCaptchaSolver"]

# F5 Distributed Cloud Bot Defense (formerly Shape Security).
# Heavy JS challenge with Akamai-style cookies + token POST.
# Fronts financial sites; passive challenge with stealth.
[provider.triggers]
selectors = ["script[src*='shape']", "[id*='shape']"]
window_globals = ["ShapeBotDefense", "_shape"]
script_src_contains = ["shapesecurity.com", "f5cloud.com", "/shape/"]


[[provider]]
name = "yandex_smartcaptcha"
priority = 24
solver_names = ["SliderCaptchaSolver", "VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Yandex SmartCaptcha — image-grid + slider variants. Common on
# Russian / CIS sites and globally on Yandex services.
[provider.triggers]
selectors = [".smart-captcha", "[data-captcha-id]"]
window_globals = ["smartCaptcha"]
script_src_contains = ["captcha-api.yandex.ru", "smartcaptcha.yandexcloud.net"]


[[provider]]
name = "tencent_captcha"
priority = 25
solver_names = ["SliderCaptchaSolver", "VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Tencent (TCaptcha) — slider + click-image variants. Heavy
# usage across China and APAC. Routes through SliderCaptchaSolver
# for the slider variant; image-grid via VLM.
[provider.triggers]
selectors = ["#tcaptcha_iframe", ".tcaptcha-container", "[data-aid*='tcaptcha']"]
window_globals = ["TencentCaptcha", "TCaptcha"]
script_src_contains = ["t.captcha.qq.com", "ssl.captcha.qq.com"]


[[provider]]
name = "keycaptcha"
priority = 26
solver_names = ["SliderCaptchaSolver", "VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# KeyCaptcha — drag-piece-into-slot puzzle. Routes through
# SliderCaptchaSolver with KeyCaptcha-specific selectors.
[provider.triggers]
selectors = ["#capcode", "#keycaptcha", ".keycaptcha"]
window_globals = ["s_s_c_user_id", "k_c_t_v"]
script_src_contains = ["www.keycaptcha.com", "backs.keycaptcha.com"]


[[provider]]
name = "sucuri_waf"
priority = 27
solver_names = ["CloudflareInterstitialSolver", "ThirdPartyCaptchaSolver"]

# Sucuri WAF interstitial — passive JS challenge that issues a
# `sucuri_cloudproxy_uuid_*` cookie on success. Found on shared-hosting
# customers and many WordPress sites.
[provider.triggers]
selectors = ["#sucuri-cloudproxy-block", "[id*='sucuri-block']"]
window_globals = ["sucuriCloudproxy"]
script_src_contains = ["cloudproxy.sucuri.net", "sucuri.net"]


[[provider]]
name = "reblaze"
priority = 28
solver_names = ["CloudflareInterstitialSolver", "WaitForTokenSolver"]

# Reblaze bot-mitigation interstitial — issues `rbzid` token cookie
# after JS challenge; fronts banks + airlines + media sites.
[provider.triggers]
selectors = ["[name='rbzid']", "iframe[src*='reblaze']"]
window_globals = ["rbzns", "rbzid"]
script_src_contains = ["reblaze.com", "rbzdns.com"]


[[provider]]
name = "netacea"
priority = 29
solver_names = ["CloudflareInterstitialSolver", "WaitForTokenSolver"]

# Netacea bot-management — server-side detection with rare interstitial.
# Occasional `_netacea_*` cookies confirm presence.
[provider.triggers]
selectors = ["[id*='netacea-block']", ".netacea-blocked"]
window_globals = ["NETACEA"]
script_src_contains = ["netacea.com", "netacea-cdn.com"]


[[provider]]
name = "radware_bot_manager"
priority = 30
solver_names = ["CloudflareInterstitialSolver", "WaitForTokenSolver"]

# Radware Bot Manager (formerly ShieldSquare) — token-cookie
# interstitial with optional captcha fallback for high-risk sessions.
[provider.triggers]
selectors = ["[id*='radware'], [data-radware]"]
window_globals = ["RADWARE", "_RWB"]
script_src_contains = ["shieldsquare.net", "shieldsquare.com", "rdwr.com"]


[[provider]]
name = "indusface_apptrana"
priority = 31
solver_names = ["CloudflareInterstitialSolver", "ThirdPartyCaptchaSolver"]

# Indusface AppTrana WAAP interstitial. Server-side bot scoring with
# JS challenge; frequent on Indian e-commerce + enterprise SaaS.
[provider.triggers]
selectors = ["[data-apptrana]", "form[action*='apptrana']"]
window_globals = ["AppTrana", "Indusface"]
script_src_contains = ["apptrana.indusface.com", "indusface.com/security"]


[[provider]]
name = "variti"
priority = 32
solver_names = ["CloudflareInterstitialSolver"]

# Variti AI bot-management — passive JS challenge, sets `_variti_*`
# session cookies. Common on European retail.
[provider.triggers]
selectors = ["[id*='variti']", ".variti-challenge"]
window_globals = ["Variti", "_variti"]
script_src_contains = ["variti.com", "varitin.com"]


[[provider]]
name = "edgio_security"
priority = 33
solver_names = ["CloudflareInterstitialSolver", "ThirdPartyCaptchaSolver"]

# Edgio (formerly Limelight Networks / Layer0) Security — challenge
# interstitial that sets `_layer0_*` cookies after passive validation.
[provider.triggers]
selectors = ["[id*='edgio']", "[id*='layer0-challenge']"]
window_globals = ["Edgio", "Layer0"]
script_src_contains = ["edg.io", "layer0.co", "edgio-security.net"]


[[provider]]
name = "stackpath_waf"
priority = 34
solver_names = ["CloudflareInterstitialSolver"]

# StackPath WAF interstitial. Sets `sp_*` cookies on JS challenge pass.
# Now Edgio-owned but legacy deployments still serve the SP signature.
[provider.triggers]
selectors = ["[id*='stackpath-block']"]
window_globals = ["StackPath"]
script_src_contains = ["stackpathcdn.com", "stackpath.com"]


[[provider]]
name = "fastly_image_optimizer_bot"
priority = 35
solver_names = ["CloudflareInterstitialSolver", "WaitForTokenSolver"]

# Fastly NGWAF (Signal Sciences) bot-management. Issues `_fastly_*`
# session token after passive validation.
[provider.triggers]
selectors = ["[data-fastly-bot]", "[id*='ngwaf-challenge']"]
window_globals = ["FastlyNGWAF", "SignalSciences"]
script_src_contains = ["fastly-insights.com", "signalsciences.net", "ngwaf.fastly.com"]


[[provider]]
name = "wordfence_advanced"
priority = 36
solver_names = ["CloudflareInterstitialSolver", "ThirdPartyCaptchaSolver"]

# Wordfence Advanced (WordPress firewall) interstitial. Two flavours:
# captcha challenge OR JS-only validation. Sets `wfwaf-authcookie-*`.
[provider.triggers]
selectors = [".wordfence-block", "[id*='wordfence']", "input[name='wordfence_logHuman']"]
window_globals = ["wordfenceAJAX"]
script_src_contains = ["wordfence.com", "/wp-content/plugins/wordfence/"]


[[provider]]
name = "cleantalk"
priority = 37
solver_names = ["CloudflareInterstitialSolver"]

# CleanTalk anti-spam (WordPress) — invisible bot scoring with rare
# captcha challenge. `ct_checkjs` cookie is the success marker.
[provider.triggers]
selectors = ["[id*='ct_check'], [name='ct_checkjs']"]
window_globals = ["ct_protect_external", "ctNocache"]
script_src_contains = ["cleantalk.org/ct.js", "cleantalk-pixel.com"]


[[provider]]
name = "hcaptcha_enterprise"
priority = 38

# hCaptcha Enterprise — distinct sitekey shape (`data-rqdata`) and
# enterprise-only `hcaptcha-checkbox` widget. Routes through the same
# hCaptcha solver pipeline but the rule lets ops differentiate per-site.
[provider.triggers]
selectors = [".h-captcha[data-rqdata]", "[data-hcaptcha-enterprise]"]
window_globals = ["hcaptchaEnterprise"]


[[provider]]
name = "recaptcha_enterprise"
priority = 39

# reCAPTCHA Enterprise — same widget shape as v2 but issued by the
# Enterprise API; recaptchaenterprise.googleapis.com is the
# back-end. Site-key starts with `6L` like v2 but enrolment differs.
[provider.triggers]
selectors = ["[data-action][data-sitekey][data-recaptcha-enterprise]"]
window_globals = ["grecaptcha.enterprise"]
script_src_contains = ["recaptcha/enterprise.js", "recaptchaenterprise.googleapis.com"]


[[provider]]
name = "fingerprint_pro"
priority = 40
solver_names = ["CloudflareInterstitialSolver"]

# Fingerprint Pro (formerly FingerprintJS Pro) — passive
# bot-detection scoring SDK. No widget; presence implies the site
# is doing client-side bot scoring. Treat as a stealth requirement.
[provider.triggers]
window_globals = ["FingerprintJS", "FPJS"]
script_src_contains = ["fpjs.io", "fingerprintjs.com", "api.fpjs.io"]


[[provider]]
name = "castle_io"
priority = 41
solver_names = ["CloudflareInterstitialSolver"]

# Castle.io account-protection signals. Passive JS bot scoring; no
# captcha widget but the SDK presence affects login flows.
[provider.triggers]
window_globals = ["_castle", "Castle"]
script_src_contains = ["castle.io/v2/c.js", "d2t77mnxyo7adj.cloudfront.net/v2/c.js"]


[[provider]]
name = "forter_protection"
priority = 42
solver_names = ["CloudflareInterstitialSolver"]

# Forter fraud-prevention SDK. Passive scoring; presence triggers
# stricter checkout flows.
[provider.triggers]
window_globals = ["forter_token", "Forter"]
script_src_contains = ["forter.com", "forter-script-loader"]


[[provider]]
name = "nocaptcha_alibaba"
priority = 43
solver_names = ["SliderCaptchaSolver", "VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Alibaba Cloud Anti-Bot Service NoCaptcha. Slider-style verification
# common on Aliexpress + 1688 + Taobao login flows.
[provider.triggers]
selectors = ["#nc_1_n1z", ".nc-container", "[id*='nc_1_']"]
window_globals = ["NoCaptcha", "noCaptcha"]
script_src_contains = ["alicdn.com/sd/nch5", "g.alicdn.com/sd/nch5"]


[[provider]]
name = "anti_bot_io"
priority = 44
solver_names = ["CloudflareInterstitialSolver", "ThirdPartyCaptchaSolver"]

# Anti-Bot.io (now part of Datadome but historically distinct) — JS
# challenge interstitial.
[provider.triggers]
selectors = ["[data-antibot]", ".antibot-challenge"]
window_globals = ["antiBot", "AntiBot"]
script_src_contains = ["anti-bot.io", "antibot-cdn.com"]


[[provider]]
name = "incapsula_protect"
priority = 45
solver_names = ["CloudflareInterstitialSolver"]

# Imperva Incapsula Protect (newer CSP-style) — distinct from
# imperva_incapsula above (which catches the legacy `_Incapsula_Resource`
# loader). Some fleet sites have moved to the newer signature.
[provider.triggers]
selectors = ["[data-incap-protect]", "iframe[src*='incapsula.com/protect']"]
window_globals = ["incapProtect"]
script_src_contains = ["protect.incapsula.com", "imperva.com/protect"]


[[provider]]
name = "bunny_shield"
priority = 46
solver_names = ["CloudflareInterstitialSolver"]

# Bunny.net Shield WAF — JS challenge + cookie token. Lightweight
# but increasingly common on smaller sites + APIs.
[provider.triggers]
selectors = ["[id*='bunny-shield']", ".bunny-challenge"]
window_globals = ["BunnyShield"]
script_src_contains = ["bunny.net/shield", "bunnycdn.com/shield"]


[[provider]]
name = "antbot_distil"
priority = 47
solver_names = ["CloudflareInterstitialSolver", "ThirdPartyCaptchaSolver"]

# Distil Networks legacy interstitial (now Imperva-owned but still
# serves on legacy contracts). Sets `D_BHA_*` cookies after passive
# validation.
[provider.triggers]
selectors = ["[id*='distil']", "iframe[src*='distilnetworks.com']"]
window_globals = ["distillation", "_distillation_"]
script_src_contains = ["distilnetworks.com", "areyouahuman.com"]


[[provider]]
name = "ddos_guard"
priority = 48
solver_names = ["CloudflareInterstitialSolver"]

# DDoS-Guard (Russia-based) interstitial — aggressive on .ru / .su
# domains. JS challenge sets `__ddg*` cookies.
[provider.triggers]
selectors = ["[id*='ddg-challenge']"]
window_globals = ["__ddg1", "__ddg2"]
script_src_contains = ["ddos-guard.net", "ddos-guard.ru"]


[[provider]]
name = "qrator_labs"
priority = 49
solver_names = ["CloudflareInterstitialSolver"]

# Qrator Labs DDoS protection interstitial — JS challenge sets
# `qrator_jsr*` cookies.
[provider.triggers]
selectors = ["[id*='qrator-challenge']"]
window_globals = ["Qrator"]
script_src_contains = ["qrator.net", "qratorlabs.com"]


[[provider]]
name = "naverpay_captcha"
priority = 50
solver_names = ["VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Naver Captcha — image-grid + audio variants common on Korean
# e-commerce + Naver login flows.
[provider.triggers]
selectors = ["#naver_captcha_image", ".naver_captcha"]
window_globals = ["NaverCaptcha"]
script_src_contains = ["naver.com/captcha", "static.nid.naver.com/captcha"]


[[provider]]
name = "kakao_captcha"
priority = 51
solver_names = ["VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Kakao image captcha (Korean). Common on Kakao login + Daum.
[provider.triggers]
selectors = [".kakao_captcha", "img[src*='captcha.kakao.com']"]
window_globals = ["KakaoCaptcha"]
script_src_contains = ["captcha.kakao.com", "captcha.daum.net"]


[[provider]]
name = "ksecure_captcha"
priority = 52
solver_names = ["SliderCaptchaSolver", "VlmCaptchaSolver"]

# KSecure (Korean banking auth) slider/click captcha.
[provider.triggers]
selectors = [".ksecure-captcha", "[data-ksecure]"]
window_globals = ["KSecure", "kSecureCaptcha"]
script_src_contains = ["ksecure.co.kr", "ksign.com"]


[[provider]]
name = "rsa_adaptive_auth"
priority = 53
solver_names = ["CloudflareInterstitialSolver"]

# RSA Adaptive Auth challenge — sometimes presents as a captcha
# escalation when device-fingerprint risk is high.
[provider.triggers]
selectors = ["[id*='rsa-adaptive-auth']", ".rsa-step-up"]
window_globals = ["RSA", "rsaAdaptive"]
script_src_contains = ["rsa.com/adaptive", "securid.com"]


[[provider]]
name = "fastlybot_solv"
priority = 54
solver_names = ["WaitForTokenSolver"]

# Fastly Bot Detection (Edge AI) — silent scoring; presence triggers
# stricter rate-limits.
[provider.triggers]
window_globals = ["FastlyBotDetection"]
script_src_contains = ["fastly-insights.com/bot", "edgeai.fastly.com"]


[[provider]]
name = "vercel_firewall"
priority = 55
solver_names = ["CloudflareInterstitialSolver", "WaitForTokenSolver"]

# Vercel Firewall (managed WAF) interstitial — JS challenge that
# issues `_vercel_jwt`-shaped tokens.
[provider.triggers]
selectors = ["[id*='vercel-firewall-challenge']"]
window_globals = ["VercelFirewall"]
script_src_contains = ["vercel.com/_firewall", "vercel-insights.com"]


[[provider]]
name = "render_shield"
priority = 56
solver_names = ["CloudflareInterstitialSolver"]

# Render Shield bot-mitigation (Render.com hosting). JS challenge
# with cookie token.
[provider.triggers]
selectors = ["[id*='render-shield-challenge']"]
window_globals = ["RenderShield"]
script_src_contains = ["render.com/shield"]


[[provider]]
name = "hostinger_protect"
priority = 57
solver_names = ["CloudflareInterstitialSolver"]

# Hostinger Protect interstitial (shared hosting). JS challenge.
[provider.triggers]
selectors = [".hostinger-challenge", "[id*='hostinger-protect']"]
window_globals = ["HostingerProtect"]
script_src_contains = ["hostinger.com/protect"]


[[provider]]
name = "ovh_anti_ddos"
priority = 58
solver_names = ["CloudflareInterstitialSolver"]

# OVH Anti-DDoS interstitial — automatic when traffic spike
# detected. JS challenge.
[provider.triggers]
selectors = ["[id*='ovh-anti-ddos']"]
window_globals = ["OVHAntiDDoS"]
script_src_contains = ["ovh.net/anti-ddos", "ovh.com/protection"]


[[provider]]
name = "qiyu_captcha"
priority = 59
solver_names = ["SliderCaptchaSolver", "VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# 网易易盾 (NetEase Yidun) captcha — slider + image-grid variants
# common across Chinese gaming + e-commerce.
[provider.triggers]
selectors = [".yidun_intelli-captcha", ".yidun_modal", "#captcha_div"]
window_globals = ["initNECaptcha", "NECaptcha"]
script_src_contains = ["c.dun.163.com", "cstaticdun.126.net"]


[[provider]]
name = "vaptcha"
priority = 60
solver_names = ["BehavioralCaptchaSolver", "VlmCaptchaSolver"]

# VAPTCHA — behavioral / drag-line / image-grid; Chinese SaaS.
[provider.triggers]
selectors = [".vaptcha-init-loading", ".vaptcha-container", "[data-vaptcha-vid]"]
window_globals = ["vaptcha"]
script_src_contains = ["v.vaptcha.com", "v3.vaptcha.com"]


[[provider]]
name = "luminati_brightdata"
priority = 61
solver_names = ["CloudflareInterstitialSolver", "WaitForTokenSolver"]

# Bright Data (formerly Luminati) anti-bot interstitial commonly
# seen on customers using their unblocker product.
[provider.triggers]
selectors = ["[id*='brightdata-challenge']", "[id*='luminati-challenge']"]
window_globals = ["BrightData"]
script_src_contains = ["brightdata.com/challenge", "luminati.io/challenge"]


[[provider]]
name = "tcaptcha_v2"
priority = 62
solver_names = ["SliderCaptchaSolver", "VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Tencent TCaptcha v2 (newer split from tencent_captcha above) —
# image grid + slider; encountered on QQ + WeChat web flows.
[provider.triggers]
selectors = ["#tcaptcha_iframe[data-aid*='_v2']", ".tcaptcha-v2"]
window_globals = ["TCaptchaV2"]
script_src_contains = ["t.captcha.qq.com/cap_union_new", "ssl.captcha.qq.com/cap_union_new"]


[[provider]]
name = "click_text_captcha"
priority = 63
solver_names = ["VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Click-text captcha — generic click-on-the-word challenges
# (e.g. "click on the cherries" / "click on tetris"). Vendor-agnostic.
[provider.triggers]
selectors = [".click-captcha", "[data-click-captcha]", "img[alt*='click on']"]


[[provider]]
name = "rotate_captcha_generic"
priority = 64
solver_names = ["BehavioralCaptchaSolver", "VlmCaptchaSolver"]

# Generic rotate-to-orient captcha — TouTiao, Bilibili, others.
# Routes through Behavioral first (snap-to-min trick), then VLM.
[provider.triggers]
selectors = [".rotate-captcha", ".captcha-rotate-image", "input[type='range'][data-rotate]"]


[[provider]]
name = "audio_captcha_generic"
priority = 65
solver_names = ["AudioCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Generic audio-only captcha (uncommon — usually a fallback for
# accessibility). Routes through whisper STT.
[provider.triggers]
selectors = ["audio.captcha-audio", "audio[data-captcha-audio]", "audio[src*='captcha']"]


[[provider]]
name = "captcha_io"
priority = 66
solver_names = ["VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Captcha.io — newer image-only captcha SaaS. Image-grid widget.
[provider.triggers]
selectors = ["[data-captcha-io]", ".captcha-io-widget"]
window_globals = ["CaptchaIO"]
script_src_contains = ["captcha.io", "captchaio.com"]


[[provider]]
name = "tunnel_captcha"
priority = 67
solver_names = ["VlmCaptchaSolver"]

# Tunnel Captcha — image+text hybrid often seen on Russian sites.
[provider.triggers]
selectors = [".tunnel-captcha", "img[src*='tunnelcaptcha']"]


[[provider]]
name = "duxcaptcha"
priority = 68
solver_names = ["VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# DuxCaptcha — Hungarian / EU image captcha SaaS.
[provider.triggers]
selectors = [".dux-captcha", "img[alt*='dux-captcha']"]
script_src_contains = ["duxcaptcha.com"]


[[provider]]
name = "humanity_captcha"
priority = 69
solver_names = ["VlmCaptchaSolver", "BehavioralCaptchaSolver"]

# Humanity Captcha — interactive puzzle SaaS (drag-to-solve).
[provider.triggers]
selectors = ["[data-humanity-captcha]", ".humanity-captcha-container"]
script_src_contains = ["humanitycaptcha.com"]


[[provider]]
name = "anubis_protection"
priority = 70
solver_names = ["WaitForTokenSolver", "CloudflareInterstitialSolver"]

# Anubis (open-source PoW interstitial used by FOSS sites to block
# scrapers). Sets a `anubis-auth` cookie after PoW.
[provider.triggers]
selectors = ["[data-anubis]", ".anubis-challenge"]
window_globals = ["AnubisChallenge"]
script_src_contains = ["anubis.techaro.lol", "/.well-known/anubis"]


[[provider]]
name = "challenge_solana"
priority = 71
solver_names = ["WaitForTokenSolver"]

# Solana RPC anti-bot interstitial — appears on public RPC endpoints
# under load. JS challenge with cookie token.
[provider.triggers]
selectors = ["[id*='solana-challenge']"]
script_src_contains = ["solana-challenge"]


[[provider]]
name = "shopify_bot_check"
priority = 72
solver_names = ["WaitForTokenSolver", "CloudflareInterstitialSolver"]

# Shopify built-in bot-check on storefront + checkout flows.
[provider.triggers]
selectors = ["[data-shopify-bot-check]", "form[action*='/checkpoint']"]
script_src_contains = ["shopifycdn.com/bot-check"]


[[provider]]
name = "magento_recaptcha_v3"
priority = 73

# Magento commerce ships reCAPTCHA v3 with a magento-specific data
# attribute. Routes through the standard reCAPTCHA chain.
[provider.triggers]
selectors = ["form[data-recaptcha-actionname][data-mage-init]"]
window_globals = ["mageRecaptcha"]


[[provider]]
name = "ezoic_human_check"
priority = 74
solver_names = ["WaitForTokenSolver", "CloudflareInterstitialSolver"]

# Ezoic ad-platform's human-check interstitial.
[provider.triggers]
selectors = ["[id*='ezoic-human']", ".ezoic-protect"]
script_src_contains = ["ezoic.com/human-check"]


[[provider]]
name = "lockdown_browser"
priority = 76
solver_names = ["WaitForTokenSolver"]

# Browser-lockdown SaaS (proctoring vendors). Detection only —
# captchaforge can't bypass remote-proctoring; flag and refuse.
[provider.triggers]
selectors = ["[data-respondus-lockdown]", "[id*='honorlock']", "[id*='proctorio']"]
window_globals = ["respondus", "Honorlock", "Proctorio"]


[[provider]]
name = "interstitial_quora"
priority = 77
solver_names = ["WaitForTokenSolver", "CloudflareInterstitialSolver"]

# Quora's bot-check interstitial — passive challenge sets `m-b3` cookie.
[provider.triggers]
selectors = ["[id*='QuoraBotCheck']"]
script_src_contains = ["quora.com/_/static/bot-check"]


[[provider]]
name = "ddos_attack_protection"
priority = 78
solver_names = ["CloudflareInterstitialSolver"]

# Generic "DDoS attack protection by ___" interstitial regex.
# Covers Sucuri, Imunify360, ModSecurity-CRS template, others.
[provider.triggers]
selectors = ["[id*='ddos-protection-page']", "[id*='attack-protection-page']"]
title_contains = ["ddos protection", "attack protection", "checking your browser"]


[[provider]]
name = "imunify360"
priority = 79
solver_names = ["CloudflareInterstitialSolver"]

# Imunify360 (CloudLinux WAF) interstitial — JS challenge.
[provider.triggers]
selectors = ["[id*='imunify360-captcha']"]
script_src_contains = ["imunify360.com", "/imunify360-webshield/"]


[[provider]]
name = "modsecurity_captcha"
priority = 80
solver_names = ["CloudflareInterstitialSolver", "ThirdPartyCaptchaSolver"]

# ModSecurity-CRS captcha rule (open-source WAF). Often deployed
# inline by Apache/Nginx ops as a soft block.
[provider.triggers]
selectors = ["form[action*='modsec-captcha']"]
title_contains = ["modsecurity", "blocked by mod_security"]


[[provider]]
name = "barracuda_waf"
priority = 81
solver_names = ["CloudflareInterstitialSolver"]

# Barracuda Web Application Firewall captcha challenge.
[provider.triggers]
selectors = ["[id*='barracuda-waf']", ".bnt-captcha"]
script_src_contains = ["barracudanetworks.com"]


[[provider]]
name = "f5_advanced_waf"
priority = 82
solver_names = ["CloudflareInterstitialSolver"]

# F5 BIG-IP Advanced WAF (formerly ASM) — challenge with `TS01_*`
# cookie tokens after passive validation.
[provider.triggers]
selectors = ["[id*='f5-block-page']", "form[action*='f5_block']"]
script_src_contains = ["f5.com/security"]


[[provider]]
name = "akamai_kona_site_defender"
priority = 83
solver_names = ["CloudflareInterstitialSolver"]

# Akamai Kona Site Defender challenge (legacy Akamai WAF, distinct
# from Bot Manager which is in akamai_bot_manager above).
[provider.triggers]
selectors = ["[id*='akamai-kona']"]
script_src_contains = ["akamaized.net/kona", "akamai.com/kona"]


[[provider]]
name = "azion_edge_firewall"
priority = 84
solver_names = ["CloudflareInterstitialSolver"]

# Azion Edge Firewall (Brazilian CDN) interstitial.
[provider.triggers]
selectors = ["[id*='azion-edge']"]
script_src_contains = ["azion.com/edge-firewall", "azioncdn.net"]


[[provider]]
name = "section_io_protect"
priority = 86
solver_names = ["CloudflareInterstitialSolver"]

# Section.io edge-protect interstitial.
[provider.triggers]
selectors = ["[id*='section-io-protect']"]
script_src_contains = ["section.io/protect"]


[[provider]]
name = "smart_captcha_yandex_v2"
priority = 87
solver_names = ["BehavioralCaptchaSolver", "VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Yandex SmartCaptcha v2 (newer rev) — distinct DOM markers from v1.
[provider.triggers]
selectors = [".smart-captcha-v2", "[data-smartcaptcha-version='2']"]
window_globals = ["smartCaptchaV2"]
script_src_contains = ["captcha-api.yandex.ru/v2", "smartcaptcha.yandexcloud.net/v2"]


[[provider]]
name = "geetest_v3_legacy_china"
priority = 88
solver_names = ["SliderCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Geetest v3 legacy CN deployments — older selectors before global rev.
[provider.triggers]
selectors = [".gt_slider", ".gt_panel", ".gt_creator"]
script_src_contains = ["api.geetest.com/static/js/api"]


[[provider]]
name = "ipipgo_protect"
priority = 89
solver_names = ["CloudflareInterstitialSolver"]

# ipipgo edge protect interstitial (Chinese hosting).
[provider.triggers]
selectors = ["[id*='ipipgo-protect']"]
script_src_contains = ["ipipgo.com"]


[[provider]]
name = "cloudflare_just_a_moment"
priority = 90

# The classic CF "Checking your browser before accessing…" interstitial.
# Most fleet sites have moved to Turnstile but legacy deployments still
# fire on title alone. Distinct from cloudflare_interstitial built-in
# (priority 5) — that catches the newer challenge-page; this catches
# legacy CF managed-challenge text-mode.
[provider.triggers]
title_contains = [
    "Just a moment",
    "Checking your browser",
    "Attention Required",
]
cookie_names = ["__cf_bm", "cf_chl_2"]


[[provider]]
name = "ddos_guard_text"
priority = 91
solver_names = ["CloudflareInterstitialSolver"]

# DDoS-Guard text-mode interstitial (text-only, no widget).
[provider.triggers]
title_contains = ["DDoS-Guard", "ddos-guard"]
cookie_names = ["__ddg1_", "__ddg2_"]


[[provider]]
name = "imperva_block_text"
priority = 92
solver_names = ["CloudflareInterstitialSolver"]

# Imperva text-mode block screen (default Incapsula block page).
[provider.triggers]
title_contains = [
    "request unsuccessful",
    "incapsula incident id",
    "imperva incident id",
]


[[provider]]
name = "qrator_text"
priority = 93
solver_names = ["CloudflareInterstitialSolver"]

# Qrator text-mode "Server too busy" interstitial.
[provider.triggers]
title_contains = ["qrator labs", "qrator.net"]
cookie_names = ["qrator_jsr"]


[[provider]]
name = "akamai_reference_block"
priority = 94
solver_names = ["CloudflareInterstitialSolver"]

# Akamai default block-page format ("Reference #18.abc.def…").
# Detection-only (block page is a hard-stop unless solved before serving).
[provider.triggers]
title_contains = ["access denied", "you don't have permission"]
cookie_names = ["akacd_phasedrelease"]


[[provider]]
name = "fastly_too_many_requests"
priority = 95

# Fastly default 429 too-many-requests page.
[provider.triggers]
title_contains = ["too many requests", "rate limited"]


[[provider]]
name = "anubis_text"
priority = 96
solver_names = ["WaitForTokenSolver"]

# Anubis default text interstitial (PoW challenge page).
[provider.triggers]
title_contains = ["making sure you're not a bot", "anubis is checking"]
cookie_names = ["anubis-auth"]


[[provider]]
name = "checkpoint_recaptcha"
priority = 97

# Cloudflare Checkpoint with embedded recaptcha — newer hybrid where
# CF surfaces a Google reCAPTCHA v2 widget instead of Turnstile.
[provider.triggers]
selectors = [".g-recaptcha[data-cf-checkpoint]"]


[[provider]]
name = "vercel_challenge"
priority = 98

# Vercel Firewall challenge page (managed WAF replacement for the
# older Vercel firewall ruleset).
[provider.triggers]
selectors = ["[data-vercel-firewall-challenge]"]
title_contains = ["vercel security checkpoint"]
cookie_names = ["_vercel_jwt"]


[[provider]]
name = "fly_io_block"
priority = 99
solver_names = ["CloudflareInterstitialSolver"]

# Fly.io default block screen for bot-detected IPs.
[provider.triggers]
title_contains = ["fly.io", "request blocked by fly"]


[[provider]]
name = "render_block"
priority = 101
solver_names = ["CloudflareInterstitialSolver"]

# Render.com default block screen.
[provider.triggers]
title_contains = ["render security check", "blocked by render"]


[[provider]]
name = "github_browser_challenge"
priority = 102

# GitHub's bot-detection interstitial (rare but real on logged-out scrapes).
[provider.triggers]
title_contains = ["browser check", "github browser challenge"]


[[provider]]
name = "stackoverflow_throttle"
priority = 103

# Stack Overflow throttle page — surfaces when scraping pulls hit limits.
[provider.triggers]
title_contains = ["too many requests", "throttled"]
selectors = ["[id*='throttled']"]


[[provider]]
name = "linkedin_security_challenge"
priority = 104
solver_names = ["WaitForTokenSolver", "ThirdPartyCaptchaSolver"]

# LinkedIn security challenge interstitial (puzzle-based).
[provider.triggers]
selectors = ["[id*='linkedin-challenge']", "form[action*='/uas/login-submit']"]
title_contains = ["security verification | linkedin"]


[[provider]]
name = "instagram_challenge"
priority = 105
solver_names = ["WaitForTokenSolver", "ThirdPartyCaptchaSolver"]

# Instagram challenge / suspicious login page.
[provider.triggers]
selectors = ["[id*='ChallengeIcon']", "form[action*='/challenge']"]
title_contains = ["help us confirm it's you"]


[[provider]]
name = "facebook_checkpoint"
priority = 106
solver_names = ["WaitForTokenSolver", "ThirdPartyCaptchaSolver"]

# Facebook checkpoint / captcha challenge.
[provider.triggers]
selectors = ["[id*='checkpoint']", "form[action*='/checkpoint']"]
title_contains = ["checkpoint - facebook", "security check"]


[[provider]]
name = "twitter_x_authchallenge"
priority = 107
solver_names = ["WaitForTokenSolver", "ThirdPartyCaptchaSolver"]

# X (Twitter) authentication challenge page.
[provider.triggers]
selectors = ["[data-testid='ocfEnterTextTextInput']"]
title_contains = ["unusual activity"]


[[provider]]
name = "amazon_robot_check"
priority = 108
solver_names = ["VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Amazon robot-check page (image captcha).
[provider.triggers]
selectors = ["form[action='/errors/validateCaptcha']"]
title_contains = ["robot check", "type the characters you see"]


[[provider]]
name = "ebay_captcha_challenge"
priority = 109
solver_names = ["VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# eBay captcha challenge page.
[provider.triggers]
selectors = ["form[action*='/socialsignin/captcha']"]
title_contains = ["captcha", "ebay verification"]


[[provider]]
name = "walmart_block"
priority = 110
solver_names = ["VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Walmart "press and hold" / hCaptcha challenge.
[provider.triggers]
selectors = ["[id*='walmart-block']", "[class*='walmart-blocked']"]
title_contains = ["robot or human", "press & hold"]


[[provider]]
name = "shopify_checkpoint"
priority = 111
solver_names = ["WaitForTokenSolver"]

# Shopify checkpoint URL.
[provider.triggers]
selectors = ["form[action*='/checkpoint']"]
title_contains = ["checkpoint", "shopify checkpoint"]


[[provider]]
name = "twitch_challenge"
priority = 112
solver_names = ["VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Twitch login captcha.
[provider.triggers]
selectors = ["[data-test-selector='captcha-prompt']"]
title_contains = ["confirm you're not a bot"]


[[provider]]
name = "reddit_block"
priority = 113

# Reddit IP block / rate-limit page.
[provider.triggers]
title_contains = ["whoa there, slow down", "reddit blocked"]


[[provider]]
name = "discord_captcha"
priority = 114
solver_names = ["VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Discord hCaptcha login challenge.
[provider.triggers]
selectors = [".h-captcha[data-sitekey^='4c672d35']"]


[[provider]]
name = "paypal_challenge"
priority = 115
solver_names = ["WaitForTokenSolver", "VlmCaptchaSolver"]

# PayPal account challenge page.
[provider.triggers]
selectors = ["form[action*='/cgi-bin/webscr?cmd=_account-challenge']"]
title_contains = ["security challenge - paypal"]


[[provider]]
name = "stripe_challenge_3ds"
priority = 116

# Stripe 3-D Secure challenge frame (technically not a captcha but
# often co-presented with one). Detection-only.
[provider.triggers]
selectors = ["iframe[src*='hooks.stripe.com/3d_secure']"]


[[provider]]
name = "google_unusual_traffic"
priority = 117
solver_names = ["VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Google "Our systems have detected unusual traffic" interstitial.
[provider.triggers]
selectors = ["form[action='/sorry/index']"]
title_contains = ["unusual traffic", "before you continue to google"]


[[provider]]
name = "google_recaptcha_invisible_v2"
priority = 118

# reCAPTCHA v2 invisible — distinct DOM markers from visible v2.
[provider.triggers]
selectors = [".g-recaptcha[data-size='invisible']"]


[[provider]]
name = "captchas_io_widget"
priority = 119
solver_names = ["VlmCaptchaSolver"]

# captchas.io image-only widget (not the same as captcha_io above).
[provider.triggers]
selectors = ["[data-captchas-io]", "img[src*='captchas.io']"]
script_src_contains = ["captchas.io/widget.js"]


[[provider]]
name = "challenge_passive_anti_ddos"
priority = 120

# Generic "passive anti-ddos" interstitial — title-only, no widget.
[provider.triggers]
title_contains = [
    "anti-ddos protection",
    "ddos mitigation",
    "verifying that you're a human",
]


# ─── Round 28 vendor expansion ─────────────────────────────────────
# More real anti-bot stacks + captcha SaaS encountered in the wild.
# Each entry below was triaged from a public bug bounty / CDN fleet
# inventory; the cookie + selector signatures come from the vendor's
# own docs (or open-source clones reverse-engineered from prod traffic).

[[provider]]
name = "qrator_advanced"
priority = 121
solver_names = ["CloudflareInterstitialSolver"]

# Qrator Advanced (newer rev) — distinct from qrator_labs / qrator_text.
[provider.triggers]
selectors = ["[id*='qrator-advanced']", "iframe[src*='qrator-cdn.net']"]
window_globals = ["QratorAdvanced"]
script_src_contains = ["qrator-cdn.net", "advanced.qrator.net"]


[[provider]]
name = "tcb_anti_robot"
priority = 122
solver_names = ["CloudflareInterstitialSolver", "ThirdPartyCaptchaSolver"]

# TencentCloudBase Anti-Robot — Tencent's CDN-bundled bot defense
# layer (separate product from t.captcha.qq.com).
[provider.triggers]
selectors = ["[data-tcb-antirobot]"]
window_globals = ["TCBAntiRobot"]
script_src_contains = ["antirobot.cloud.tencent.com", "tcb-antirobot.cn"]


[[provider]]
name = "huawei_cloud_waf"
priority = 123
solver_names = ["CloudflareInterstitialSolver"]

# HuaweiCloud WAF interstitial — common on HK/CN-fronted sites.
[provider.triggers]
selectors = ["[id*='hwcloud-waf']"]
script_src_contains = ["hwcloud.com/waf", "huaweicloud.com/waf-challenge"]
cookie_names = ["HWWAFSESID"]


[[provider]]
name = "alibaba_anti_bot_v3"
priority = 124
solver_names = ["CloudflareInterstitialSolver", "BehavioralCaptchaSolver"]

# Alibaba Cloud Anti-Bot v3 (split out from Anti-Bot v2 / NoCaptcha).
[provider.triggers]
selectors = ["[data-aliab-v3]"]
window_globals = ["AliyunAntiBot"]
script_src_contains = ["antibot.aliyuncs.com/v3", "g.alicdn.com/anti-bot/v3"]


[[provider]]
name = "tencent_yunjia"
priority = 125
solver_names = ["CloudflareInterstitialSolver", "WaitForTokenSolver"]

# Tencent Yunjia (云加) host security interstitial.
[provider.triggers]
selectors = ["[data-yunjia-block]"]
script_src_contains = ["yunjia.qcloud.com", "yunjia.tencent.com"]


[[provider]]
name = "baidu_yunjia"
priority = 126
solver_names = ["CloudflareInterstitialSolver"]

# Baidu YunJia bot defense — BaiduCloud's WAF challenge.
[provider.triggers]
selectors = ["[id*='baidu-yunjia']"]
script_src_contains = ["yunjiasu.baidu.com", "yunjia.baidu.com"]


[[provider]]
name = "myhuaweicloud_anti_bot"
priority = 127
solver_names = ["CloudflareInterstitialSolver"]

# myHuaweiCloud Anti-Bot Service.
[provider.triggers]
selectors = ["[id*='hwc-antibot']"]
script_src_contains = ["myhuaweicloud.com/antibot"]


[[provider]]
name = "salesforce_shield"
priority = 128
solver_names = ["CloudflareInterstitialSolver"]

# Salesforce Shield (anti-bot fronting Salesforce-hosted sites).
[provider.triggers]
selectors = ["[id*='sfshield-block']"]
script_src_contains = ["salesforce.com/shield"]


[[provider]]
name = "oracle_dynroute_waf"
priority = 129
solver_names = ["CloudflareInterstitialSolver"]

# Oracle DynRoute / Oracle Cloud WAF challenge.
[provider.triggers]
selectors = ["[id*='dynroute-block']"]
script_src_contains = ["dynroute.oracle.com", "oraclecloud.com/waf"]


[[provider]]
name = "edgenext_protect"
priority = 130
solver_names = ["CloudflareInterstitialSolver"]

# EdgeNext Protect (Asia-focused CDN).
[provider.triggers]
selectors = ["[id*='edgenext-protect']"]
script_src_contains = ["edgenext.com/protect"]


[[provider]]
name = "bitninja_protect"
priority = 131
solver_names = ["CloudflareInterstitialSolver"]

# BitNinja Server Security captcha challenge.
[provider.triggers]
selectors = [".bitninja-captcha", "[id*='bitninja']"]
script_src_contains = ["bitninja.io"]
title_contains = ["security check by bitninja"]


[[provider]]
name = "shieldon"
priority = 132
solver_names = ["CloudflareInterstitialSolver", "ThirdPartyCaptchaSolver"]

# Shieldon WAF (PHP open-source firewall, common on shared hosting).
[provider.triggers]
selectors = [".shieldon-captcha", "[name='shieldon_captcha']"]
script_src_contains = ["shieldon.io"]
title_contains = ["shieldon protection"]


[[provider]]
name = "anti_bot_ninja"
priority = 133
solver_names = ["CloudflareInterstitialSolver"]

# AntiBot.Ninja interstitial (cheap bot-defense SaaS).
[provider.triggers]
selectors = ["[id*='antibot-ninja']"]
script_src_contains = ["antibot.ninja"]


[[provider]]
name = "spamprotect_app"
priority = 134
solver_names = ["CloudflareInterstitialSolver"]

# SpamProtect.app (newer EU-based bot-defense).
[provider.triggers]
selectors = ["[data-spamprotect]"]
script_src_contains = ["spamprotect.app"]


[[provider]]
name = "antibot_cloud"
priority = 135
solver_names = ["CloudflareInterstitialSolver"]

# AntiBot.Cloud captcha service.
[provider.triggers]
selectors = ["[id*='antibot-cloud']"]
script_src_contains = ["antibot.cloud"]


[[provider]]
name = "buzzcaptcha"
priority = 136
solver_names = ["VlmCaptchaSolver"]

# BuzzCaptcha image-only widget.
[provider.triggers]
selectors = [".buzzcaptcha", "[data-buzzcaptcha]"]
script_src_contains = ["buzzcaptcha.com"]


[[provider]]
name = "solvemedia"
priority = 137
solver_names = ["VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# Solve Media (legacy ad-revenue captcha SaaS, still on some sites).
[provider.triggers]
selectors = ["#adcopy-puzzle-image", "iframe[src*='solvemedia.com']"]
script_src_contains = ["api.solvemedia.com"]


[[provider]]
name = "bauhaus_captcha"
priority = 138
solver_names = ["VlmCaptchaSolver"]

# Bauhaus Captcha — image+text challenge (German SaaS).
[provider.triggers]
selectors = ["[data-bauhaus-captcha]"]
script_src_contains = ["bauhaus-captcha.de"]


[[provider]]
name = "siteguarding"
priority = 139
solver_names = ["CloudflareInterstitialSolver"]

# SiteGuarding WordPress plugin captcha challenge.
[provider.triggers]
selectors = [".siteguarding-captcha"]
script_src_contains = ["siteguarding.com/wp-captcha"]


[[provider]]
name = "sitelock_protect"
priority = 140
solver_names = ["CloudflareInterstitialSolver"]

# SiteLock TrueShield WAF interstitial.
[provider.triggers]
selectors = ["[id*='sitelock-block']"]
script_src_contains = ["sitelock.com/trueshield"]


[[provider]]
name = "malcare_block"
priority = 141
solver_names = ["CloudflareInterstitialSolver"]

# MalCare WordPress firewall block screen.
[provider.triggers]
selectors = ["[id*='malcare-block']"]
script_src_contains = ["malcare.com/firewall"]


[[provider]]
name = "ninjafirewall"
priority = 142
solver_names = ["CloudflareInterstitialSolver"]

# NinjaFirewall (WordPress) captcha challenge.
[provider.triggers]
selectors = [".ninjafirewall-captcha"]
title_contains = ["ninjafirewall blocked"]


[[provider]]
name = "succuri_lite"
priority = 143
solver_names = ["CloudflareInterstitialSolver"]

# Sucuri Security Lite (free WP plugin) interstitial.
[provider.triggers]
selectors = [".sucurisecurity-block"]
script_src_contains = ["sucurisecurity-block"]


[[provider]]
name = "cloudways_security"
priority = 144
solver_names = ["CloudflareInterstitialSolver"]

# Cloudways managed-hosting security-block interstitial.
[provider.triggers]
selectors = ["[id*='cloudways-block']"]
title_contains = ["cloudways security alert"]


[[provider]]
name = "kinsta_block"
priority = 145
solver_names = ["CloudflareInterstitialSolver"]

# Kinsta WP-hosting bot-block page.
[provider.triggers]
selectors = ["[id*='kinsta-block']"]
title_contains = ["blocked by kinsta"]


[[provider]]
name = "wpengine_security"
priority = 146
solver_names = ["CloudflareInterstitialSolver"]

# WP Engine security-challenge interstitial.
[provider.triggers]
selectors = ["[id*='wpengine-security']"]
title_contains = ["wpengine security challenge"]


[[provider]]
name = "siteground_protect"
priority = 147
solver_names = ["CloudflareInterstitialSolver"]

# SiteGround managed-hosting bot block.
[provider.triggers]
selectors = ["[id*='siteground-block']"]
title_contains = ["siteground bot protection"]


[[provider]]
name = "linode_block"
priority = 148
solver_names = ["CloudflareInterstitialSolver"]

# Linode default bot-block page.
[provider.triggers]
title_contains = ["blocked by linode", "linode security"]


[[provider]]
name = "digitalocean_block"
priority = 149
solver_names = ["CloudflareInterstitialSolver"]

# DigitalOcean default bot-block page.
[provider.triggers]
title_contains = ["blocked by digitalocean", "digitalocean rate limited"]


[[provider]]
name = "hetzner_block"
priority = 150
solver_names = ["CloudflareInterstitialSolver"]

# Hetzner default bot-block page.
[provider.triggers]
title_contains = ["blocked by hetzner", "hetzner security"]


[[provider]]
name = "scaleway_block"
priority = 151
solver_names = ["CloudflareInterstitialSolver"]

# Scaleway default bot-block page.
[provider.triggers]
title_contains = ["blocked by scaleway"]


[[provider]]
name = "vultr_block"
priority = 152
solver_names = ["CloudflareInterstitialSolver"]

# Vultr default bot-block page.
[provider.triggers]
title_contains = ["blocked by vultr"]


[[provider]]
name = "tailscale_funnel_block"
priority = 153
solver_names = ["CloudflareInterstitialSolver"]

# Tailscale Funnel — public-tunnel proxy bot challenge.
[provider.triggers]
title_contains = ["tailscale funnel"]


[[provider]]
name = "ngrok_warning"
priority = 154

# Ngrok free-tier visit-warning interstitial (counts as a soft block
# because no bot can dismiss it without parsing the page text).
[provider.triggers]
selectors = ["a[href*='ngrok.com'][class*='visit']"]
title_contains = ["you are about to visit", "ngrok warning"]


[[provider]]
name = "browserling_check"
priority = 155
solver_names = ["CloudflareInterstitialSolver"]

# Browserling-style "verifying you are not a bot" interstitial
# (open-source clone widely deployed on FOSS forums).
[provider.triggers]
title_contains = ["verifying you are not a bot", "browserling-style check"]


[[provider]]
name = "go_captcha"
priority = 156
solver_names = ["VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# go-captcha (open-source Go captcha library, drag-and-drop puzzle).
[provider.triggers]
selectors = [".go-captcha", "[data-go-captcha]"]
script_src_contains = ["go-captcha"]


[[provider]]
name = "svelte_captcha"
priority = 157
solver_names = ["VlmCaptchaSolver"]

# svelte-captcha (community widget for SvelteKit apps).
[provider.triggers]
selectors = [".svelte-captcha"]


[[provider]]
name = "vuetcha"
priority = 158
solver_names = ["BehavioralCaptchaSolver", "VlmCaptchaSolver"]

# Vuetcha (Vue-component captcha).
[provider.triggers]
selectors = [".vuetcha-container"]


[[provider]]
name = "ngcaptcha"
priority = 159
solver_names = ["VlmCaptchaSolver"]

# Angular ngcaptcha widget.
[provider.triggers]
selectors = ["ng-captcha", "[data-ngcaptcha]"]


[[provider]]
name = "react_simple_captcha"
priority = 160
solver_names = ["VlmCaptchaSolver", "MathCaptchaSolver"]

# React-simple-captcha (popular MIT-licensed widget).
[provider.triggers]
selectors = ["#user_captcha_input", ".react-simple-captcha-canvas"]


[[provider]]
name = "audio_visual_captcha"
priority = 161
solver_names = ["AudioCaptchaSolver", "VlmCaptchaSolver"]

# Generic audio-visual captcha (image + audio fallback button).
[provider.triggers]
selectors = ["[data-captcha-audio][data-captcha-image]"]


[[provider]]
name = "captcha_invasion"
priority = 162
solver_names = ["VlmCaptchaSolver"]

# Captcha-Invasion (open-source canvas-based widget).
[provider.triggers]
selectors = [".captcha-invasion", "canvas[data-captcha-invasion]"]


[[provider]]
name = "drag_to_match"
priority = 163
solver_names = ["BehavioralCaptchaSolver", "VlmCaptchaSolver"]

# Generic "drag puzzle piece into matching slot" challenge — widely
# cloned widget shape across multiple SaaS vendors.
[provider.triggers]
selectors = [".drag-to-match-captcha", "[data-drag-match]"]


[[provider]]
name = "click_in_order_captcha"
priority = 164
solver_names = ["VlmCaptchaSolver"]

# "Click these images in this order" captcha — common on hackathon /
# CTF sign-ups + Geetest-influenced clones.
[provider.triggers]
selectors = ["[data-click-order-captcha]", ".click-order-captcha"]


[[provider]]
name = "qcaptcha"
priority = 165
solver_names = ["VlmCaptchaSolver"]

# QCaptcha (Quranic-script captcha used on Arabic-language sites).
[provider.triggers]
selectors = [".qcaptcha-img", "[data-qcaptcha]"]


[[provider]]
name = "icaptcha_text"
priority = 166
solver_names = ["VlmCaptchaSolver", "ThirdPartyCaptchaSolver"]

# iCaptcha text-distortion widget (Indian SaaS).
[provider.triggers]
selectors = [".icaptcha-text", "img[src*='icaptcha']"]


[[provider]]
name = "snk_captcha"
priority = 167
solver_names = ["BehavioralCaptchaSolver"]

# Snake-trail captcha — user must drag along a path. Behavioral.
[provider.triggers]
selectors = [".snk-captcha", "[data-snake-captcha]"]


[[provider]]
name = "rotate_orient_v2"
priority = 168
solver_names = ["BehavioralCaptchaSolver", "VlmCaptchaSolver"]

# Rotate-to-orient v2 — newer Geetest/Tencent clone with
# 360° smooth slider.
[provider.triggers]
selectors = [".rotate-orient-v2", "[data-rotate-v2]"]


[[provider]]
name = "matrix_captcha"
priority = 169
solver_names = ["MathCaptchaSolver", "VlmCaptchaSolver"]

# Matrix-arithmetic captcha (multi-cell + sum).
[provider.triggers]
selectors = [".matrix-captcha", "[data-matrix-captcha]"]


[[provider]]
name = "logarithm_captcha"
priority = 170
solver_names = ["MathCaptchaSolver", "VlmCaptchaSolver"]

# Logarithm/algebra captcha (educational sites).
[provider.triggers]
selectors = [".logarithm-captcha", "img[alt*='log']"]


[[provider]]
name = "checkbox_grid_captcha"
priority = 171
solver_names = ["BehavioralCaptchaSolver"]

# Generic checkbox-grid "select all that match" captcha.
[provider.triggers]
selectors = ["[data-checkbox-grid-captcha]", ".checkbox-grid-captcha"]