Find hidden trackers

Think of a shop where the security guard wears the shop's own uniform but is really employed by someone else. A visitor counting "outside staff" would never spot them. Hidden trackers work like that.

1. CNAME cloaking

In the crawl records, each request has cname: where DNS says the host really points, or None. A cloaked request has a host on the page's own site, and a CNAME on a listed tracker. Careful: many sites point subdomains at a content delivery network such as edge.cdn.example. That is normal, so check the CNAME's site against TRACKER_LIST.

Safari limits cookies set through CNAME-cloaked responses to 7 days, and Firefox lets blocking extensions look up CNAMEs to uncloak them; Chrome extensions cannot do that lookup (checked October 2026).

2. Bounce chains

When you click a link, it can pass through a tracker's redirect on the way, letting it set or read its own first-party cookie. You met bounce tracking in Leg 6; here you count it at scale. Each record has click_chain: the URLs the crawler passed through after clicking the page's first outbound link. A middle hop is a bounce if its site differs from both the starting site and the final site. A site redirecting through its own /out page is not a bounce.

3. Fingerprinting scripts

An instrumented crawler records which browser features each script used, in scripts. Following the approach of published studies, a script is suspicious when it both reads back a drawing or sound (CANVAS_READS) and reads at least 4 different device traits (TRAIT_APIS). A drawing app that only exports your picture uses the canvas but reads few traits, so it does not count.

from watched.leg7b_web import CANVAS_READS, TRAIT_APIS
apis = ["canvas.toDataURL", "navigator.userAgent", "screen.width",
        "navigator.languages", "Intl.timeZone"]
reads_canvas = any(a in CANVAS_READS for a in apis)
traits = {a for a in apis if a in TRAIT_APIS}      # a set: each trait once
print(reads_canvas, len(traits))                   # True 4

Watch for fingerprinting served from the site's own host. No third-party list would catch it; only behaviour does.

A common misconception: "If my blocker shows zero third-party trackers, nothing tracks me." Cloaked, bounced and first-party fingerprinting trackers all slip past a list of third-party names. Behaviour-based checks, like the ones you write here, are how browsers and researchers find them.

// JavaScript
function isFingerprinting(apis) {
  const readsCanvas = apis.some(a => CANVAS_READS.includes(a));
  const traits = new Set(apis.filter(a => TRAIT_APIS.includes(a)));
  return readsCanvas && traits.size >= 4;
}

// PHP
function is_fingerprinting(array $apis): bool {
    $reads = count(array_intersect($apis, CANVAS_READS)) > 0;
    $traits = count(array_unique(array_intersect($apis, TRAIT_APIS)));
    return $reads && $traits >= 4;
}