Aha has this person never seen the JS google/CF run for bot detection?

The browser APIs spit out so much info about the host system on demand and that doesnt even consider the other tricks they use.