Local Qwen 7B Bypassed a Classifieds Site's Anti-Fraud via a DOM Agent

⚡ The Gist in 5 Seconds

• The author made a local Qwen-class 7B/8B model search listings on a major classifieds platform through a real Edge browser — no proxies, no paid search APIs.
• Everything runs in the Strata sandbox: Python, Playwright, and the system msedge in visible mode with headless=False.
• The anti-fraud wasn't broken: the bet was that the protection would see an ordinary user, rather than on spoofing packets.

🔍 What Happened

Habr published an article by Phonetastic. The task sounded mundane: find a flagship mobile workstation with a rare professional GPU on a popular classifieds site. It didn't work right away.

Direct requests hit HTTP 403 and HTTP 429. The WAF blocked the model at the network level. A workaround via search engines with the site: operator also failed. One returned "You are not a robot," the second hung on a timeout due to an allow-list inside Strata, and the third returned an empty JavaScript redirect stub.

So the author changed the architecture and built a "visual-textual DOM agent." The first pillar — the model takes over the Edge browser already installed on the system. Playwright starts with channel="msedge", headless=False, the flags --start-maximized and --focus, plus a call to page.bring_to_front(). The window pops up on top of everything, followed by an 8-second pause so the page can load. To the protection system, this looks like an ordinary browser launch by a human.

The second pillar — the agent deliberately ignores CSS. Classes like .styles-module-root-XyZ12 are generated on the server and change with every frontend update. The model scans the DOM in a single pass and latches onto semantic markers: when it finds a text node with a currency symbol, that's the anchor point. From there it climbs up to the parent container and extracts the data. No proxies — just Python and Playwright.

🧠 Our Take

This news isn't about "AI hacked a site." It's about a shift in approach: instead of fighting the network at the packet level — imitating a human at the level of pixels and logic. Our verdict: this is the most boring, and therefore the most effective, conclusion. Anti-fraud systems have spent years learning to catch navigator.webdriver = true and non-human timings. There's nothing to catch here — the browser is real, the window is real, and so is the pause.

What does this change? For the scraping market, it's a signal that "banning headless" is no longer a universal answer. For platform owners, it's a reason to look not at browser flags but at behavior: how many listings are opened per session and what queries are being sent. For the wallet, a local 7B/8B model instead of paid APIs and proxy pools looks cheaper. The only catch: the author provides no figures on speed or cost per run.

Who wins? Developers who need a narrow search on a single site: they now have a reproducible recipe. Who loses — in our assessment, antibot services that build detection solely on browser fingerprints. The race here is symmetric: as soon as the 8-second pause and bring_to_front() become widespread, they'll start being caught by behavior.

⚠️ What We Don't Know

The main weakness — it's a single source. This is the author's personal account, with no independent verification. The text doesn't name the platform, and there's no time per pass, number of listings processed, or query statistics before the ban. It's unclear what happens after the agent climbs to the parent container: the fragment cuts off mid-sentence. A separate question is whether the scheme will still work a month from now, after a frontend update. You'll have to test it yourself.

Forecast: within a quarter, two or three open-source agents with the same logic will appear on GitHub, and major platforms will start counting behavioral metrics more actively instead of checking browser flags.

Disclaimer: one source — the author's personal experience on Habr; nothing has been officially confirmed.

Source: Habr