@p i wonder how the tcp packages look. one could filter for "windows send this package" back in the day, maybe the scrapers do have some unique fingerprints as well.
@bonifartius I ran ja3er on the tcpdump output for a while. Chrome decided to try to defeat SSL fingerprinting, so anyone using Headless Chrome is hard to spot just from the packets.