Download websites that use GeeTest

About GeeTest

A bot defence on a page is a form of confession. Nobody pays for one on a site that nothing is trying to break into. Where a Security tag of this kind appears, there was enough credential stuffing, scraping, spam registration or automated buying to justify a vendor contract instead of leaving the form open.

GeeTest comes from Wuhan Luoan Technology Co., Ltd. and has been in the market since 2012 on a Proprietary basis. As of September 2026 we detect it on 9,747 sites. The product replaces the click and squint challenge with a slide puzzle and a risk engine that scores how a visitor moves, types and pauses before deciding whether to challenge at all, so a large share of ordinary visitors never see anything. Deployment concentrates where abuse costs money: login, registration, checkout, ticket release and any endpoint that hands out something scarce.

Origin matters when reading this tag. Wuhan Luoan Technology Co., Ltd. built the product for a market where automated abuse against gaming, ticketing, ecommerce and financial platforms is heavily industrialised, and its footprint grew outward from that base. A site that chose it over a Western default has usually made a deliberate decision, often because an alternative provider is slow, unfamiliar or unreachable for the visitors it serves. The tag can therefore be read as a weak signal about intended audience as much as about security posture, though it deserves treating as a hypothesis to test against the rest of a site's stack rather than as a conclusion.

Detection has a structural limit here. We record the platform from the script the challenge loads into a page, which captures sites serving the widget somewhere we can crawl and misses installs that appear only behind a login, only on a form rendered after user interaction, or only for visitors a risk engine has already decided to distrust. Adaptive defences are intermittent by design, so undercounting is built into the method rather than accidental. The count means sites where we saw the challenge, not every site that has bought it.

For a researcher the useful question is never whether one domain runs a particular CAPTCHA. The questions that matter are which populations pay for bot defence at all, how that set overlaps with payment providers, gaming platforms or ticketing systems, which country code domains carry it, and how the set shifts between snapshots as sites change vendors after an incident. Security vendors run displacement campaigns off exactly that list, fraud teams use it to size a market, and researchers use it to track where automated abuse is expensive enough to fight. Each of those needs the whole detected set in one file with the co-detected stack attached, which a per domain lookup cannot assemble.