Supercookie Detection

Identifies tracking that exploits HTTP Strict Transport Security flags to store persistent identifiers. Attackers encode values by toggling HSTS policies across subdomains, creating a bit-encoded fingerprint that survives cache clearing.

• Monitors HSTS cache state across subdomain requests
• Detects anomalous 307 Internal Redirect patterns
• Flags domains using HSTS as a storage channel
• Cross-references with known tracker domain lists

Detects the abuse of favicon caches to store persistent identifiers. Trackers force browsers to cache unique favicon combinations across subdomains, creating a combinatorial identifier that persists even after cookies are cleared.

• Analyzes favicon request patterns for enumeration behavior
• Detects subdomain chains serving unique favicon.ico files
• Monitors cache probing via onload/onerror event timing
• Flags domains with excessive favicon subdomain variations

Identifies the misuse of HTTP ETag headers as persistent storage. ETags are cache validation tokens that browsers store indefinitely; trackers set unique ETag values that are echoed back on subsequent requests, functioning as a respawnable identifier.

• Inspects ETag values for encoded user identifiers
• Correlates ETag consistency across cleared sessions
• Detects If-None-Match header fingerprinting patterns
• Flags servers setting ETags without Cache-Control headers

Detects tracking via TLS session IDs and session tickets. These cryptographic tokens persist across browser restarts and can encode identifiers that survive all user clearing actions, operating below the HTTP layer.

• Monitors TLS handshake for static session ID reuse
• Detects session ticket rotation patterns indicating encoding
• Analyzes Server Name Indication (SNI) field consistency
• Flags connections with abnormally persistent session parameters

Identifies tracking that probes browser storage APIs to reconstruct identifiers. Trackers test LocalStorage, IndexedDB, Service Worker caches, and other isolated storage mechanisms to find residual data after clearing attempts.

• Detects rapid sequential reads across storage APIs
• Monitors for storage quota probing patterns
• Flags cross-origin storage access attempts
• Identifies Service Worker registration as persistence vector

Links supercookie identifiers to browser fingerprinting signals for respawning. When a user clears cookies, trackers match the recreated fingerprint to a previously stored supercookie value, restoring the identifier.

• Correlates canvas fingerprint with HSTS snapshot state
• Detects fingerprint-to-supercookie binding events
• Monitors for identifier respawning after clearing events
• Flags domains combining multiple persistence techniques

Detecting the abuse of HTTP Strict Transport Security (HSTS) flags to create a persistent identifier. Attackers encode a unique value by setting HSTS policies across a range of subdomains (e.g., bit0.example.com, bit1.example.com).

• Mechanism: The browser stores a binary state (HSTS on/off) for each subdomain.
• Detection: Forensic analysis of HSTS cache entries and monitoring for requests to a large number of non-existent subdomains on a single apex domain.
• Indicator: A script that systematically probes 32+ subdomains to reconstruct a 32-bit user ID.

Identifying the use of favicon caches as a storage vector. A tracking script forces the browser to request a unique set of favicons from distinct paths, encoding a user ID in the pattern of cached and uncached icons.

• Mechanism: The script checks if a specific favicon is loaded from cache (fast) or fetched from the network (slow) using the onload event.
• Detection: Monitoring for rapid, sequential requests to numerous unique favicon URLs on a single domain, especially those returning 404 or 301 status codes.
• Red Flag: JavaScript that iterates through an array of paths like /id-0.ico, /id-1.ico and measures load timing.

Detecting the use of ETag HTTP response headers to respawn deleted cookies. The server sets a unique ETag value for a cached resource, which the browser sends back on subsequent requests via the If-None-Match header.

• Mechanism: Even after a user clears cookies, the browser cache retains the ETag, allowing the server to reconstruct the identifier.
• Detection: Inspecting network traffic for static resources with ETag values that appear to be high-entropy strings or Base64-encoded data, rather than standard content hashes.
• Forensic Artifact: An ETag value that remains constant across multiple cache-clearing events.

Uncovering tracking via TLS Session Identifiers. A server can issue a unique Session ID during the TLS handshake, which the client caches and presents on the next connection to resume the session without a full handshake.

• Mechanism: The Session ID acts as a persistent token stored outside of the browser's cookie jar.
• Detection: Analyzing the ClientHello message in TLS traffic for Session IDs that persist across browser restarts and cookie deletions.
• Key Distinction: Legitimate session resumption uses short-lived tickets; supercookies use long-lived, static identifiers.

Detecting tracking scripts that abuse the Storage API to estimate available disk space and generate a semi-unique fingerprint. By requesting a specific quota and measuring the granted bytes, a script can derive a device-specific value.

• Mechanism: navigator.storage.estimate() returns quota and usage data that can vary slightly between browsers and devices.
• Detection: Monitoring for scripts that call the Storage API without any legitimate file-saving or caching operation.
• Context: This is often combined with other signals to create a high-entropy cross-browser fingerprint.