Skip to main content

Website evidence · pilot dataset

Does aa.com fingerprint you?

Fingerprinting indicators observed.

The latest measured scans include canvas drawing and readback by the same script. Some activity was recorded on a challenge page. One browser setup is unmeasured or missing. This is a fingerprinting indicator, not proof of tracking intent or transmission.

Open evidence JSON ↗

All 8 source records are included in the JSON. Scan timestamps and versions are shown as recorded. The tabs show the latest usable homepage measurement for each setup. Later failed attempts remain in the history. Scan scope and methodology ↗

Inside the scan

← All websites

Visitor setup

Draw + readback

5 of 5 signal families observed

Canvas: ObservedWebGL: ObservedAudio: ObservedFonts: ObservedDevice: Observed
Measurement
Measured
Page context
Challenge page
Scan time
2026-10-22T19:41:24.734560Z
Browser / scanner
156.0.8078.4 / 0.4

Captured titleAccess Denied

CanvasDraws text and reads canvas output.4 API entries

Observed requires a text-drawing API and a canvas readback API. Guide ↗

canvas.getContext4 calls

Frame: https://www.aa.com/

  • Inline caller recorded
  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
canvas.toDataURL1 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
canvas2d.fillText2 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
canvas2d.measureText11 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
WebGLQueries the graphics environment.4 API entries

Observed requires at least three distinct WebGL probing APIs. Guide ↗

webgl2renderingcontext.getExtension4 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
webgl2renderingcontext.getParameter22 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
webglrenderingcontext.getExtension1 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
webglrenderingcontext.getParameter2 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
AudioRenders or reads audio samples.7 API entries

Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗

analyser.getFloatFrequencyData1 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
analyser.getFloatTimeDomainData1 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
audio.createAnalyser2 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
audio.createDynamicsCompressor1 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
audio.createOscillator2 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
audiobuffer.getChannelData1 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
offlineaudio.startRendering1 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
FontsMeasures text repeatedly.1 API entries

Observed requires at least ten text-measurement calls. Guide ↗

canvas2d.measureText11 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
DeviceReads browser and display properties.14 API entries

Observed requires at least three distinct browser, screen, or window properties. Guide ↗

navigator.deviceMemory2 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
navigator.hardwareConcurrency2 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
navigator.language1 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
navigator.languages2 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
navigator.maxTouchPoints2 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
navigator.platform4 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
navigator.plugins19 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
navigator.userAgent5 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
navigator.webdriver3 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
screen.colorDepth2 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
screen.height2 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
screen.pixelDepth2 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
screen.width2 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
window.devicePixelRatio3 calls

Frame: https://www.aa.com/

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
Scripts with both text drawing and canvas readback 1

These source URLs appear in both call groups. Aggregated logs do not preserve the full execution sequence or establish the purpose of the collection.

  • https://www.aa.com/pBXINolzX/lINi0/HSAw3/ORr6rBwg/mXQuzpN1uc/JmUzAQ/DSU5F1t/kIi4V
Providers, script signatures, and DNS 0 provider labels

Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.

No provider or DNS evidence in this record.

Network and worker observations 5 requests
Captured scripts
1
Instrumented frames
1
Google Ads observed
No
Transmission evidence
Not validated

Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.

Third-party hosts

    Other recorded API calls 2
    • document.cookie.read28 calls
    • document.cookie.write2 calls
    Source record and integrity
    Original source
    results/headful/aa-com-20261022T194124.json
    Original file SHA-256
    3203dca7f47c561a0ccda1ce2ae37c4ba928c0d0bc2e5727eb5f83f41ed31d7e

    Run ID: headful-3203dca7f47c. The JSON contains sanitized observations, not the original private scan payload.

    Other scan attempts (5)

    Visitor setup

    Navigation failed

    Navigation failed

    Canvas: UnmeasuredWebGL: UnmeasuredAudio: UnmeasuredFonts: UnmeasuredDevice: Unmeasured
    Measurement
    Navigation failed
    Page context
    Page not measured
    Scan time
    2026-10-21T23:15:49.925316Z
    Browser / scanner
    156.0.8078.4 / 0.3
    Navigation failed — no usable scan result

    Navigation or page loading failed in this browser setup. The record does not establish why it failed.

    Source record and integrity
    Original source
    results/headful/aa-com-20261021T231549.json
    Original file SHA-256
    10744a473152420be76b115da59bdbb8b04cdcd38bf0d923b42f90a571b39495

    Run ID: headful-10744a473152. The JSON contains sanitized observations, not the original private scan payload.

    Visitor setup

    Scanner error

    Scanner error

    Canvas: UnmeasuredWebGL: UnmeasuredAudio: UnmeasuredFonts: UnmeasuredDevice: Unmeasured
    Measurement
    Scanner error
    Page context
    Page not measured
    Scan time
    2026-10-22T13:33:49.062116Z
    Browser / scanner
    156.0.8078.4 / 0.4
    Scanner error — no usable scan result

    The scanner crashed while collecting this page. No usable API results were saved for this setup. A fresh scan is needed; this is not a site-blocking verdict.

    Source record and integrity
    Original source
    results/headful/aa-com-20261022T133349.json
    Original file SHA-256
    28de362fd0488fe502978b6f44b0a6b629e43eed730c53c25ee7f5619861f2fd

    Run ID: headful-28de362fd048. The JSON contains sanitized observations, not the original private scan payload.

    Visitor setup

    Navigation failed

    Navigation failed

    Canvas: UnmeasuredWebGL: UnmeasuredAudio: UnmeasuredFonts: UnmeasuredDevice: Unmeasured
    Measurement
    Navigation failed
    Page context
    Page not measured
    Scan time
    2026-10-22T13:33:52.372402Z
    Browser / scanner
    156.0.8078.4 / 0.4
    Navigation failed — no usable scan result

    Navigation or page loading failed in this browser setup. The record does not establish why it failed.

    Source record and integrity
    Original source
    results/headful/aa-com-20261022T133352.json
    Original file SHA-256
    744d7a33307a22571da5c35e9c92cf4948b9f17a9d99d507c9bfa1a1f5984544

    Run ID: headful-744d7a33307a. The JSON contains sanitized observations, not the original private scan payload.

    Visitor setup

    Scanner error

    Scanner error

    Canvas: UnmeasuredWebGL: UnmeasuredAudio: UnmeasuredFonts: UnmeasuredDevice: Unmeasured
    Measurement
    Scanner error
    Page context
    Page not measured
    Scan time
    2026-10-22T19:38:53.087380Z
    Browser / scanner
    156.0.8078.4 / 0.4
    Scanner error — no usable scan result

    The scanner crashed while collecting this page. No usable API results were saved for this setup. A fresh scan is needed; this is not a site-blocking verdict.

    Source record and integrity
    Original source
    results/headful/aa-com-20261022T193853.json
    Original file SHA-256
    c382cc2d66b5065b1e0df72c10a77f9d45e0d06f671448dd136127e2e2fc4531

    Run ID: headful-c382cc2d66b5. The JSON contains sanitized observations, not the original private scan payload.

    Visitor setup

    Scanner error

    Scanner error

    Canvas: UnmeasuredWebGL: UnmeasuredAudio: UnmeasuredFonts: UnmeasuredDevice: Unmeasured
    Measurement
    Scanner error
    Page context
    Page not measured
    Scan time
    2026-10-22T19:41:23.898048Z
    Browser / scanner
    156.0.8078.4 / 0.4
    Scanner error — no usable scan result

    The scanner crashed while collecting this page. No usable API results were saved for this setup. A fresh scan is needed; this is not a site-blocking verdict.

    Source record and integrity
    Original source
    results/headful/aa-com-20261022T194123.json
    Original file SHA-256
    584261d705e4f5460222ec0094979b63ad07519dc88d300ff5face294e812489

    Run ID: headful-584261d705e4. The JSON contains sanitized observations, not the original private scan payload.

    Research setup

    Unmeasured

    Unmeasured

    Canvas: UnmeasuredWebGL: UnmeasuredAudio: UnmeasuredFonts: UnmeasuredDevice: Unmeasured
    Measurement
    Unmeasured
    Page context
    Challenge page
    Scan time
    2026-10-22T17:27:12.932820Z
    Browser / scanner
    156.0.8078.4 / 0.4
    Unmeasured — no usable scan result

    Only a challenge page was measured; the normal page remains unmeasured.

    Source record and integrity
    Original source
    results/headless/aa-com-20261022T172712.json
    Original file SHA-256
    18a68288445998d743a13edf06bbd99e9c83a753ce5c4cce234f29c99c0dccd6

    Run ID: research-18a682884459. The JSON contains sanitized observations, not the original private scan payload.

    Other scan attempts (1)

    Research setup

    Not observed

    0 of 5 signal families observed

    Canvas: Not observedWebGL: Not observedAudio: Not observedFonts: Not observedDevice: Not observed
    Measurement
    Measured
    Page context
    Challenge page
    Scan time
    2026-10-21T21:25:09.252627Z
    Browser / scanner
    156.0.8078.4 / 0.3

    Captured titleAccess Denied

    CanvasDraws text and reads canvas output.1 API entries

    Observed requires a text-drawing API and a canvas readback API. Guide ↗

    canvas.getContext1 calls

    Frame: https://aa.com/

    • Inline caller recorded
    WebGLQueries the graphics environment.0 API entries

    Observed requires at least three distinct WebGL probing APIs. Guide ↗

    No matching API call was captured.

    AudioRenders or reads audio samples.0 API entries

    Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗

    No matching API call was captured.

    FontsMeasures text repeatedly.0 API entries

    Observed requires at least ten text-measurement calls. Guide ↗

    No matching API call was captured.

    DeviceReads browser and display properties.0 API entries

    Observed requires at least three distinct browser, screen, or window properties. Guide ↗

    No matching API call was captured.

    Providers, script signatures, and DNS 0 provider labels

    Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.

    No provider or DNS evidence in this record.

    Network and worker observations 1 requests
    Captured scripts
    0
    Instrumented frames
    1
    Google Ads observed
    No
    Transmission evidence
    Not validated

    Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.

    Third-party hosts

      Source record and integrity
      Original source
      results/headless/aa-com-20261021T212509.json
      Original file SHA-256
      84052f57b178a089a2784a1855c4415c2697657fae67fdc1aa1bd43f85778ca7

      Run ID: research-84052f57b178. The JSON contains sanitized observations, not the original private scan payload.

      Queries, request bodies, cookies, extracted values, raw errors, and session payloads are excluded before publication. The source digest identifies the original private record.

      Read the sanitized JSON →