Bekbol

Introduction

Play the game

A portfolio by

Bekbolot Abdilazhanov

Bot detection, browser fingerprinting, and the infrastructure underneath.

Software EngineerIncheon, South Korea

01The adversary

Bots pretend to be human. I build the systems that catch them.

On a live Bittensor subnet, miners compete to write the best bot detectors. I design the challenges, build the bots that attack them, and keep the scoring honest.

02By the numbers

As of

  • 9+

    Detection challenges

    Designed and maintained on a live Bittensor subnet

  • 25+

    Automation drivers

    Selenium to commercial anti-detect browsers, one interface

  • 870

    Tests in the bot runner

    The minimal install stays testable without paid software

  • ~840

    Subnet commits

    Plus 60 merged PRs across 36 repositories

  • 100+

    NGINX site configs

    A production edge across 9 domains, moved into git

  • 30,000+

    Wasted LLM calls stopped

    A re-analysis loop, found and fixed

03

Selected work

08 frames

  1. Bot detection

    Aug 2026 – nowChallenge designer & lead developer

    The Extension Tracer

    0.75 → 0.63AI-miner score after v2 hardening

    A public challenge where miners write page JavaScript that works out which browser extensions are running in a real Chrome session. I designed it and built the service end to end.

    • Shipped v1.0.0 as a live subnet challenge five weeks after the first commit.
    • Hardened it to an 89-extension pool and 438 tests.
    • v2 rewrites extension code every round, with a fail-closed leak scan, so only behaviour scores.
    • Pushed AI-miner scores down: Codex 0.75 → 0.63, GLM 0.62 → 0.47.
    • Python
    • FastAPI
    • Selenium
    • Chrome for Testing
    • JavaScript
    • Docker
  2. Fingerprinting & anti-detect

    Dec 2025 – Sep 2026Challenge designer & developer

    Catching the disguised browser

    5 daysFlowPrint, rename to v1.0.0

    Challenges that ask miners to unmask commercial anti-detect browsers, re-identify real devices across browsers, and classify operating systems from network traffic.

    • Proposed the anti-detect detection challenge, then led a ~4,100-line migration to ADA-3.
    • Shipped ADA-3 v3.0.0 and five patch releases in one month.
    • Built device-fingerprint scoring on real devices across 5 browsers, with race-free per-request sessions.
    • Took the FlowPrint OS-classification challenge from rename to v1.0.0 in five days.
    • Python
    • FastAPI
    • JavaScript
    • Anti-detect browsers
    • Docker
  3. Adversarial tooling

    May – Sep 2026Creator & main developer

    One bot, every driver

    870automated tests

    A browser-automation runner: define a bot once in YAML and run it on any driver, from plain Selenium to paid anti-detect browsers. It became the team's standard for testing detectors.

    • Put 25+ automation drivers behind one five-method plugin contract.
    • Integrated five commercial anti-detect browsers across Linux, macOS and Docker.
    • Fixed silent data bugs: 10 profiles acting as 1, 40% duplicate headless runs.
    • Recovered 180 of 180 historical batches and made the install about 4× lighter.
    • Python
    • FastAPI
    • Playwright
    • Selenium
    • Puppeteer
    • Docker
  4. Open source

    Sep 2025 – nowSubnet Maintainer, RedTeam Subnet

    Keeping a live subnet honest

    ~840commits across 36 repositories

    RedTeam turns security research into competitive challenges that validators score and reward on-chain. I keep its core, scoring and releases healthy.

    • Standardised CI/CD versioning across 10 repositories in one day.
    • Refactored a Rust scoring engine from 6,739 to 78 lines, adding about 190 tests.
    • Built an internal FastAPI service for lint checks and LLM code comparison in plagiarism scoring.
    • Rebalanced challenge incentive weights and wrote the subnet's security policy.
    • Python
    • Bittensor
    • FastAPI
    • Rust
    • GitHub Actions
    • Fluent Bit
  5. AI / LLM

    Jan – Oct 2026Full-stack developer

    An LLM that reads untrusted code

    30,000+redundant LLM requests eliminated

    An internal research dashboard where an LLM agent reads every miner submission, extracts its techniques, and shows researchers what works and who copies whom.

    • Found a Gemini re-analysis loop firing 30,000+ redundant requests; fixed it with a skip window.
    • Cut API list payloads by about 95–98%, replacing 1–3 s filtering with one request.
    • Contained a production Celery memory leak, then removed Celery altogether.
    • Co-built an AI red/blue-team loop, owning the supervisor's state machine and stop conditions.
    • Next.js
    • TypeScript
    • FastAPI
    • PostgreSQL
    • Gemini
    • Langfuse
  6. Infrastructure

    2026 – nowInfrastructure, HumbleBee AI

    The company edge, as code

    100+site configs under version control

    HumbleBee AI's NGINX edge used to be edited by hand on the server. I moved it into git with review, CI checks and health-checked deploys, and run it day to day.

    • Moved the live configs into git in one 109-file PR; now 100+ sites across 9 domains.
    • Built CI that tests every change with nginx -t and health-checks each deploy.
    • Standardised Cloudflare CI/CD on 7 websites: PR previews and semantic releases.
    • Cut Workers SSR CPU about 70% by moving image optimization to build time.
    • NGINX
    • GitHub Actions
    • Cloudflare Workers
    • Docker
    • Tailscale
    • Uptime Kuma
  7. Backend & APIs

    Jul – Nov 2026Backend engineer

    Backends for money, sport and rides

    4 daysfrom foundation to CI-deployed staging

    Backends for three young products: a cross-border remittance fintech, a sports-booking startup and a ride-hailing startup. Different domains, the same rule: correctness first.

    • Built a remittance pipeline with seven provider legs, four executing real on-chain transactions.
    • Laid a sports-booking backend foundation in 4 days, deployed to staging by CI.
    • Added a transactional outbox, Ed25519 tokens and a fail-closed rate limiter in Redis.
    • Designed a ride state machine with ordered row locking and one-active-ride constraints.
    • FastAPI
    • PostgreSQL
    • SQLAlchemy
    • Redis
    • Celery
    • Docker
  8. Play

    Nov 2026 – nowSolo designer & developer

    The Infinite Observatory

    This site's other half: a 3D world you fly through, where my work stands as architecture. Built for fun first, with every word also readable as plain HTML.

    • Arcade flight, ghost racing, photo mode and a hangar, on keyboard, gamepad or touch.
    • The Chronicle: a cinematic flight through my history, driven by real commit counts.
    • Live commits fall as meteors, with repo and client names stripped before they ship.
    • Per-frame state outside React, an HTML fallback, and respect for reduced motion.
    • Next.js
    • React Three Fiber
    • three.js
    • Rapier
    • zustand
    • TypeScript

04

The craft

  1. Bot detection & adversarial design

    I design challenges where only real signal scores, then attack them until that holds.

    • 9+ detection and fingerprinting challenges on a live subnet
    • Per-round code polymorphism with fail-closed leak scans
    • Caught harness flaws that let a no-skill detector score near-perfectly
    • Sized scoring statistically: about 300 negatives to certify ≤1% false positives
  2. Backend & APIs

    Typed, tested Python services that fail closed.

    • FastAPI, async SQLAlchemy, PostgreSQL, Redis and Celery in production
    • Transactional outbox, Ed25519 tokens, GCRA rate limiting
    • Rust scorer cut from 6,739 to 78 lines
    • Test suites of 870 and 438 for the tools I lead
  3. Infrastructure & DevOps

    Production edges that live in git and deploy themselves.

    • 100+ NGINX site configs across 9 domains, with HTTP/3
    • One Cloudflare CI/CD pipeline on 7 websites
    • Versioning standardised across 10 repositories in a day
    • About 15 services deployed and monitored with Uptime Kuma and Beszel
    • Logs shipped with Fluent Bit to Loki
  4. AI / LLM engineering

    LLMs as components: budgeted, observable, and pointed at real problems.

    • An LLM agent that analyses untrusted code for every subnet challenge
    • 30,000+ redundant Gemini requests removed
    • AI-miner benchmarks used to harden challenges before release
    • Led AI and engineering for a six-person English–Russian voice-agent team project

Stack

  • Python
  • TypeScript
  • Rust
  • SQL
  • FastAPI
  • Pydantic
  • SQLAlchemy
  • PostgreSQL
  • Redis
  • Celery
  • pytest
  • Playwright
  • Selenium
  • Puppeteer
  • Chrome DevTools Protocol
  • Next.js
  • React
  • React Three Fiber
  • Docker
  • NGINX
  • GitHub Actions
  • Cloudflare Workers
  • Tailscale
  • Gemini API
  • Bittensor

05

The journey

  1. First commits at HumbleBee AI

    Started shipping on the company website and the internal engineering docs.

  2. Joined the RedTeam Subnet

    Began work on Bittensor SN61: the public blog, the dashboards and the subnet core.

  3. A challenge of my own

    Proposed the anti-detect automation challenge and rebuilt device fingerprinting around real phones.

  4. Inha University co-op begins

    Three co-op terms at HumbleBee AI, almost all of it on bot detection and its tooling.

  5. The bot runner

    One YAML bot, any automation driver; it grew to 25+ drivers and 870 tests.

  6. The edge goes into git

    Moved the company NGINX edge into version control, with CI-checked deploys. It now holds 100+ site configs.

  7. Co-op complete, 100/100

    Rated 100/100 by the host company in the final term, the same month ADA-3 shipped.

  8. The Extension Tracer goes live

    BEX v1.0.0 launched on the subnet with an 89-extension pool.

  9. Now

    Hardening BEX v2 against AI miners, researching CDP detection, and building this world.

06Interactive

The Infinite Observatory

Everything on this page also exists as a world. Take the hovercraft, fly through the twilight megastructure, and race your own ghost.

  • Arcade flight on keyboard, gamepad or touch
  • Ghost racing against a hologram of your best lap
  • Photo mode with depth of field and six filters
  • A hangar of paint jobs and trails, unlocked by achievements
  • Sky whales, auroras and an adaptive soundtrack
  • Real commits falling as meteors, and The Chronicle of how it all got built

W A S D · Mouse · Space — or touch / gamepad

Credits

Written, engineered and directed by
Bekbolot Abdilazhanov
Detection systems
Browser Extension Tracer
Anti-Detect Automation Detection
Device Fingerprinter
FlowPrint
Humanize Behaviour
Stunt drivers
Playwright
Selenium
Puppeteer
Patchright
nodriver
Camoufox
…and the rest of the 25+
Adversaries
AI miners
Commercial anti-detect browsers
Every bot that tried
Built with
Python
FastAPI
TypeScript
Next.js
React Three Fiber
Docker
NGINX
Filmed on location
Incheon, South Korea
Special thanks
The HumbleBee AI team
The RedTeam Subnet miners
Inha University