BotGuard / SearchGuard: experiments, October 18, 2026
Separate corpora
- October 17: four sessions, three profiles, nine SERPs, 43 Google documents. The detailed VM-read observations belong to this corpus.
- VPS pilot: 37 trial records plus one extra navigation in an open session. Three records stopped at the IP check before Google. Chromium comparison invalidated by version/control issues.
- Controlled VPS series: 21 navigations, three fresh source profiles and nine retained/deleted-NID pairs, one fixed US VPN exit.
- Offline work: 96 VM replays on four samples (64 initial matrix + 16 random-draw controls + 16 wrapper-preserving controls), plus 48 synthetic controller cases.
Access and session
On the initial Swiss VPN, fresh Camoufox obtained three SERPs after challenge; headed and headless Chrome each recorded three refusals. HTTP without JavaScript remained on a challenge in three trials. On the native VPS exit, fresh Camoufox obtained three SERPs after challenge, headed Chrome three refusals. These are configuration observations, not general success rates.
Controlled series: all three fresh sources obtained SERPs after challenge; nine retained-NID copies obtained direct SERPs; nine deleted-NID copies obtained SERPs after challenge. IP was stable before and after every navigation; observed runtime identity was identical. Eight of nine pairs differed only in NID among cookies actually transmitted; one also differed in __Secure-STRP. The waits of 5/35/120 seconds start at context opening, not SG_SS issuance, and do not establish cookie validity at 30 seconds.
Camoufox binary Firefox 135.0.1-beta.24; Python package 0.4.11; Playwright 1.51.0. Chrome 153.0.8010.52. Cached Chromium 141/revision 1194 mismatched expected missing revision 1161. Query: musée du Louvre site officiel, fr-FR, hl=fr, gl=fr. The controlled series used a fixed US exit despite requesting France; all branches share that condition.
Quality is not certified
All 21 controlled SERPs contain an identified louvre.fr domain. No videos were detected through H3 results, identifiable video-source links/cards or module headings; this heuristic can miss unlabelled cards. Three of nine pairs have disjoint extracted title sets. The homepage-title candidate appears at rank 1 on three pages, rank 7 on seventeen, and is not identified on one. Sitelink presentation also affects extraction.
The six retained-NID pages with the homepage candidate at rank 7 record Validate, while the three retained-NID pages with rank 1 do not within the observation window. This is exploratory: challenged pages also have a low homepage rank without Validate. It is not a global quality classifier.
The pilot’s nineteen captured SERPs also show ranking variation on VPN and native IP, without detected videos. No contemporaneous independent human reference exists; opaque /goto links were not followed. Neither poisoning nor its absence is established. Abundant videos remain a candidate signal, not a proved signature of detection. October 17 YouTube-VM observations belong to a different corpus.
Offline VM controls
Original A/B outputs are stable on all four samples. Bare extraction changes all four outputs. Restoring one missing Math.random draw only restores extracted IoM. Preserving the original wrapper and extracted inner code restores all four outputs; formatting that inner code changes all four again, twice per condition. This supports source-text sensitivity without locating a specific integrity mechanism. Additional accessor hooks leave original outputs unchanged in this offline harness; this does not prove invisible instrumentation online. Immediate about:blank child-frame coverage remains uncertain. No generated token was sent to Google.
All 48 synthetic controller cases match assertions and the reconstruction: totals 4092/4093/4094, old cookie present/absent, write accepted/rejected, ss_cgi true/false, ce=30/0. The strict <4093 transport condition and stale-SG_SS presence check are reproduced. The two-second fallback is a help path, not necessarily VM cancellation. Server acceptance is unknown.
Captured protocol
The pilot records X-Sg-Cs:s then a retry 678 ms later on /async/callback:6761 with added sei and X-Sg-Ss (1072 characters), followed by X-Sg-Cs:a. Method, body and other compared parameters stay identical; response bytes grow from 59 to 260350. Request mode: 1,isrpe=1,hcs=1. HAR does not identify the JavaScript initiating stack.
The controlled series records twelve intermediate documents with ce=30, ss_cgi=false, challenge_version=0, r=1. Its six Validate token lengths are 1403, 1404, 1400, 1424, 1448, 1435; the pilot had 1441 and 1417, versus 1471–1544 in nine initial-corpus calls. No X-Sg-Cs appears in the controlled series. HTTP 200, blank responses and similar token lengths do not establish acceptance.
Limits and retained evidence
Visibility testing was inconclusive: tabs, popup and actual X11 window unmapping never produced document.hidden=true. No valid visible/hidden Google comparison is claimed. Pilot instrumentation and session comparisons had one repetition per branch and unfrozen fingerprints. Existing VPS services remained active. No personal Google account; sequential trials, alternating order, 20-second pauses; explicit refusal ends a trial without switching IP to seek success. Native VPS access was tested sparingly in the pilot, not revisited in phase two.
Flow classes distinguish direct SERP, SERP after challenge, unfinished challenge, refusal and other. Network documents and JavaScript navigations supplement structural/title/link checks. 201 final private capture files were hashed and checked. VPN rotation was restored and recovery timers removed. Raw headers, cookies, tokens, HAR, profiles and screenshots remain private. Public CSVs contain only allowlisted summaries.