AliExpress anti-bot scripts blocked one user's Bluetooth handoff by playing nothing

Why it matters

Anti-bot scripts can reach beyond tracking and consume real system resources. Here, silent fingerprinting bypassed familiar mute controls and altered Bluetooth behavior, leaving users without an obvious way to identify or stop it.

AliExpress loaded two obfuscated Alibaba security scripts that created silent Web Audio processing graphs and, on one user's Windows setup, prevented multipoint Bluetooth headphones from switching audio back to a phone, according to a technical analysis published August 20th.

The finding turns an otherwise invisible piece of anti-fraud infrastructure into a hardware problem. The scripts generated and analyzed audio without an <audio> or <video> element, so muting the AliExpress tab, Firefox or Windows did not release the computer's audio connection. Closing the tab did.

The analysis comes from the operator of the laserphile blog, identified on the site as m-c-tech. It documents one configuration rather than a broad test across headphones, operating systems and browsers. The underlying browser activity, however, was captured by instrumenting the page's Web Audio interfaces and tracing the scripts that created each audio context.

Two scripts and no audible sound

The investigation began after a pair of multipoint headphones repeatedly stopped playing audio from a phone while an AliExpress page was open on a connected PC. The interruption appeared several seconds after the page loaded and ended immediately when the tab closed.

An initial inspection found no media elements, playback calls, active Media Session or visible content that could account for the behavior. The author then wrapped the browser's AudioContext constructor and AudioNode.connect() method to log audio-processing activity.

The AliExpress homepage created two running audio contexts. Stack traces led to Alibaba-hosted files named collina.js and fireyejs.js, both stored under an AWSC directory associated with Alibaba's browser security tooling.

Alibaba Cloud's own documentation describes AWSC JavaScript components as part of its no-interaction verification product. Separate documentation for its anti-bot systems says browser-side collectors gather environmental characteristics, automation indicators and user behavior. Alibaba Cloud says these signals help distinguish human users from bots and can be injected across every page of a protected website.

An Alibaba developer article also identifies fireye.js as part of an AWSC security system used for anti-scraping, anti-abuse and human-versus-bot detection. That article says calls within the script collect low-level hardware information and can consume significant processing resources.

A fingerprint that reaches the audio output

According to the laserphile analysis, both scripts constructed a similar processing chain: a sawtooth oscillator fed an analyzer and script processor, followed by a gain node set to zero and a connection to the system audio destination.

The zero-gain setting made the result inaudible. The final destination connection still caused the browser to process the graph through the computer's audio path. On the author's setup, that activity was enough to keep the PC side of the multipoint connection active, blocking the headphones from returning to phone audio.

The Web Audio specification defines an audio context as a graph of connected processing nodes, with the destination representing the final audio output. Browser documentation similarly notes that a destination commonly maps to speakers or another physical output device, while a gain value of zero effectively mutes the signal.

Browser autoplay protections do cover Web Audio, although their behavior depends on settings, prior interaction and whether the audio is considered inaudible. MDN's current autoplay guidance says muted or zero-volume media may be permitted automatically. That leaves room for a silent processing graph to run without producing the sound that autoplay restrictions were designed to stop.

The broader script inspection found code examining canvas output, WebGL properties, screen dimensions, hardware concurrency, device memory, supported media formats, WebRTC behavior, timing information and user interaction. It also found code for encrypting and transmitting collected results to Alibaba telemetry services.

Those measurements match established browser-fingerprinting techniques. The W3C's security analysis of Web Audio specifically warns that oscillators and audio analyzers can expose small differences in signal processing, CPU architecture, resampling and rounding behavior. Combined with graphics, hardware and interaction data, those differences can help distinguish one browser environment from another.

AliExpress's privacy policy says the marketplace automatically collects device identifiers, browser and operating-system details, hardware and software attributes, browsing patterns and interaction data. It lists fraud detection, account security, analytics, advertising and personalization among its uses for collected information.

The browser-side evidence establishes that the scripts collected and transmitted fingerprint-like measurements. It does not determine whether Alibaba treated the result as a persistent device identifier, a temporary anti-bot signal or one input among many in a fraud-risk score.

The author tested narrowly targeted uBlock Origin rules against the two script families. Blocking both stopped the audio contexts from appearing while leaving ordinary homepage and product browsing functional in that test. The author cautioned that disabling anti-fraud code could produce additional verification checks or interfere with login and payment flows.

The sharper issue sits inside the implementation. AliExpress's security code performed enough live audio work to affect external hardware, while the browser controls a user would reasonably try - including tab mute - had no effect. An anti-bot system designed to disappear into the background instead announced itself by taking over the headphones.