You launch a headless Chrome instance, point it at a target site, and the first response is a 403 or a CAPTCHA. The IP is residential. The user-agent string looks like a normal Chrome. The block still lands. The signal that gave you away is usually the fingerprint — the cluster of browser properties an anti-bot service reads before it ever...