Hard targets
The sources that fight back
A pass rate only means something next to the target it was measured against. 100% against a
public JSON storefront and 100% against a reCAPTCHA behind an ASP.NET postback flow are not
the same achievement — so here are the hostile ones, each with the specific mechanism it has
to get past and the real nightly number from the same golden-diff canary that drives
the board.
This is 12 of 44 published actors. The other
32 hit plain HTML or an official public API — easy targets, and we
list them as such below. That's the point: if we dressed those up, you'd
have no reason to believe these.
- CAPTCHA
- reCAPTCHA v2 (SC) + image CAPTCHA (NM), inherited
- Stack
- Apify actor-to-actor orchestration over 8 state-board actors (ASP.NET WebForms, Socrata open data, PSI portal)
- Source
- CSLB, CT DCP, DBPR, NM CID, CCB, SC LLR, TDLR, L&I
- Auth
- Apify API token (own run token); MCP connector for delivery, credentials injected server-side by Apify's proxy
This actor hits no portal itself — it calls the deployed per-state lookup actors, so it inherits their difficulty. Two of the eight are CAPTCHA-gated on the search POST: SC LLR (reCAPTCHA v2, solved via DeathByCaptcha token job) and NM CID (SimpleCaptcha image, solved via DeathByCaptcha image job). The solves happen inside those child actors and are billed by them, which is why NM and SC cost ~$0.03 per licence against ~$0.004 elsewhere.
Difficulty here is aggregation, not evasion: eight boards that disagree on date format, on whether a status field exists (TDLR publishes none) and on whether an expiry date exists (SC LLR publishes none). The work is refusing to paper over those differences.
Matched the golden fixture on 29 of the last 30 canary runs against this target — 97%.
- CAPTCHA
- reCAPTCHA v2 (SC) + image CAPTCHA (NM), inherited
- Stack
- Apify actor-to-actor routing over 17 state-board actors (ASP.NET WebForms, Socrata open data, PSI portal, bulk rosters)
- Source
- AL LBGC, AR ACLB, CSLB, CT DCP, FL DBPR, MA CSL, MI LARA, MN DLI, NCLBGC, NM CID, NV NSCB, OR CCB, SC LLR, TN DOCI, TX TDLR, VA DPOR, WA L&I
- Auth
- Apify API token (own run token)
Hits no portal itself — it routes to the deployed per-state lookup Actors and inherits their difficulty. Two of the seventeen are CAPTCHA-gated on the search POST: SC LLR (reCAPTCHA v2) and NM CID (SimpleCaptcha image), both solved via DeathByCaptcha inside those child actors. That is why SC measures 30.8s and NM 19.6s against a 13.3s median.
The difficulty is reconciliation, not evasion: seventeen boards that disagree on date format, on whether a status field exists (AL/TX/VA publish none), on whether an expiration date exists (NC/SC publish none), and on what a status word means — 'Voluntary Surrender' is not 'Revoked'. The verdict enum is where that work lands.
Matched the golden fixture on 30 of the last 30 canary runs against this target — 100%.
- CAPTCHA
- Image CAPTCHA (distorted text)
- Stack
- HTML form POST
- Source
- NM CID
A plain <img> CAPTCHA with no grecaptcha/sitekey anywhere in the page (PSI Exams' portal). Solved via DeathByCaptcha's image job — upload the bytes, get the answer text, type it into the form field.
Recon originally shelved this against the wrong sub-portal. The real CID portal is public.psiexams.com, and its CAPTCHA is a plain image — a different solver from South Carolina's.
Matched the golden fixture on 30 of the last 30 canary runs against this target — 100%.
- CAPTCHA
- reCAPTCHA v2
- Stack
- ASP.NET WebForms (__VIEWSTATE / __EVENTVALIDATION)
- Source
- SC LLR
Google reCAPTCHA v2 on the search POST. Solved via DeathByCaptcha token job (sitekey + pageurl → g-recaptcha-response), then replayed in the form POST.
The hardest target in the portfolio: a reCAPTCHA v2 sitting on top of a WebForms postback flow. Both must be defeated on every run.
Matched the golden fixture on 30 of the last 30 canary runs against this target — 100%.
- Stack
- ASP.NET WebForms (__VIEWSTATE / __EVENTVALIDATION)
- Source
- CSLB
No CAPTCHA and no proxy. Hidden WebForms state is scraped and replayed on every POST. The listbox quirk is the real difficulty: lbCounty honours multiple values, lbClassification silently collapses to one, so trades are looped and counties are batched (docs/cslb-multiselect.md).
Insufficient canary data so far — no pass rate is claimed for this actor yet.
- Stack
- ASP.NET WebForms (__VIEWSTATE / __EVENTVALIDATION)
- Source
- CSLB
No CAPTCHA. Hidden WebForms state must be scraped and replayed on every request, and CSLB's postback flow drives the paging.
Matched the golden fixture on 30 of the last 31 canary runs against this target — 97%.
- Stack
- ASP.NET WebForms (__VIEWSTATE / __EVENTVALIDATION)
- Source
- CSLB
No CAPTCHA. Same WebForms postback flow as the directory actor, driving verify/search plus personnel lookup.
Matched the golden fixture on 30 of the last 31 canary runs against this target — 97%.
- Stack
- Classic ASP - a three-step stateful session flow where every hidden input from the previous page is echoed back to page through results. Hidden form state, though classic-ASP rather than ASP.NET __VIEWSTATE.
- Source
- DBPR
The most hostile directory target: 10 results per page, hidden-field replay for every page, and DBPR is known to challenge datacenter IPs - the code raises when the body comes back 'access denied' / 'unusual traffic', and the run has to be retried through the Apify residential proxy.
Matched the golden fixture on 28 of the last 30 canary runs against this target — 93%.
- Stack
- MyLicense (ASP.NET WebForms) - __VIEWSTATE / __EVENTVALIDATION harvested from the search page and replayed; results paged by __doPostBack
- Source
- MA OPSI (MyLicense)
Stateful and session-bound: a detail-page guid is only valid for the session's current result set, so each page of results must be enriched inline. No CAPTCHA (no grecaptcha/sitekey anywhere in the markup).
Matched the golden fixture on 30 of the last 30 canary runs against this target — 100%.
- Stack
- Accela Citizen Access (ASP.NET WebForms) - __VIEWSTATE plus session cookies replayed on every POST; 10 rows per page
- Source
- MI LARA (Accela)
The most stateful target in the suite: every page of results costs a VIEWSTATE-replaying postback, plus one detail GET per row. No anti-bot wall, but Accela rejects clients that do not present a browser User-Agent.
Matched the golden fixture on 30 of the last 30 canary runs against this target — 100%.
- Stack
- GLSuite (ASP.NET WebForms) - __VIEWSTATE / __EVENTVALIDATION replayed; a mode autopostback precedes any non-licence search; detail via __doPostBack
- Source
- NV NSCB
No CAPTCHA and no anti-bot, but every search needs a fresh VIEWSTATE and each record costs an extra postback to reach its detail page.
Matched the golden fixture on 29 of the last 30 canary runs against this target — 97%.
- Stack
- Redfin internal /stingray JSON APIs (in-page fetch) + Zillow Next.js __NEXT_DATA__
- Source
- Redfin & Zillow
Both sites block plain HTTP on TLS/browser fingerprint — curl and datacenter proxies get 403/429, not just an IP block. A real browser with a realistic fingerprint clears Redfin's robot wall and reads its cookie-gated /stingray JSON; Zillow adds a PerimeterX JS challenge (needs residential proxy + stealth) so it ships best-effort. Realtor's Akamai WAF hard-blocks even a real browser and is stubbed.
Matched the golden fixture on 30 of the last 30 canary runs against this target — 100%.
What we can't do
A site whose product is honest measurement should publish its failures. These are ours.
JS-challenge walls are not CAPTCHAs and we do not defeat them.
PerimeterX, Cloudflare and DataDome run a JavaScript challenge before any form is reachable.
No CAPTCHA token opens that — there is nothing to solve. Beating one needs a paid
web-unlocker, which we don't buy, so those targets are out of scope. We have no code for
reCAPTCHA v3, hCaptcha, or Incapsula either.
The casualty: saas-review-battlecard was built end to end —
parser, schema, pricing, tests — and then shelved at smoke-run when its
review sources turned out to sit behind exactly such a wall. It has never shipped. That
actor is why "prove the target is reachable before you build it" is now the first rule in
this repo.
We also don't render pages in a browser (every actor is plain httpx on the light
image — no Playwright anywhere) and no actor requires a proxy or IP rotation to work. If a
target needed any of that, it would be listed above under what we can't do.
Contractor License Expiration Monitor & Alerts (Notion) CAPTCHA-walled 
