Skip to main content

Website evidence · pilot dataset

Does x.com fingerprint you?

Fingerprinting indicators observed.

The latest measured scans include canvas drawing and readback by the same script. This is a fingerprinting indicator, not proof of tracking intent or transmission.

Open evidence JSON ↗

All 4 source records are included in the JSON. 2 older runs have no recorded timestamp; missing provenance stays unknown. The tabs show the latest usable homepage measurement for each setup. Later failed attempts remain in the history. Scan scope and methodology ↗

Inside the scan

← All websites

Earlier measurement shown. Review the scan time and subsequent attempts below.

Visitor setup

Draw + readback

3 of 5 signal families observed

Canvas: ObservedWebGL: Not observedAudio: Not observedFonts: ObservedDevice: Observed
Measurement
Measured
Page context
Page document
Scan time
2026-10-19T06:19:02.011435Z
Browser / scanner
156.0.8078.4 / 0.3

Captured titleX. It’s what’s happening / X

CanvasDraws text and reads canvas output.6 API entries

Observed requires a text-drawing API and a canvas readback API. Guide ↗

canvas.getContext1 calls
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 39360
canvas.getContext70 calls

Frame: https://x.com/

  • Inline caller recorded
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 11192
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 7 · col 6101
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 7 · col 7111
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 250091
canvas.toDataURL7 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 2373
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 7 · col 20296
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 92547
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 214200
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 218871
canvas2d.fillText28 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 214118
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 214141
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 214165
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 248867
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 250195
canvas2d.getImageData24 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 9891
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 99635
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 249295
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 250234
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 253039
canvas2d.measureText313 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 16941
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 249265
WebGLQueries the graphics environment.2 API entries

Observed requires at least three distinct WebGL probing APIs. Guide ↗

webglrenderingcontext.getExtension4 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 12481
webglrenderingcontext.getParameter2 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 60686
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 167492
AudioRenders or reads audio samples.0 API entries

Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗

No matching API call was captured.

FontsMeasures text repeatedly.1 API entries

Observed requires at least ten text-measurement calls. Guide ↗

canvas2d.measureText313 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 16941
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 249265
DeviceReads browser and display properties.21 API entries

Observed requires at least three distinct browser, screen, or window properties. Guide ↗

navigator.deviceMemory2 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 296030
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 221871
navigator.doNotTrack1 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 65167
navigator.hardwareConcurrency2 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 296030
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 221871
navigator.language2 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 221871
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 243073
navigator.languages4 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 2480
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 296030
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 95465
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 221871
navigator.maxTouchPoints9 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 2899
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 135973
  • https://abs.twimg.com/x-web/x-web/assets/startup-BrB_8jTs.jsline 5 · col 69600
  • https://abs.twimg.com/x-web/x-web/assets/startup-vendor-JfxF0Mjo.jsline 29 · col 76267
navigator.mimeTypes3 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 10541
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 27596
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 221871
navigator.platform2 calls
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 124117
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 124154
navigator.platform3 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 296030
  • https://abs.twimg.com/x-web/x-web/assets/startup-vendor-JfxF0Mjo.jsline 29 · col 76229
navigator.plugins4 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 88499
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 218349
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 221871
navigator.userAgent2 calls
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 65554
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 65616
navigator.userAgent80 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/startup-BrB_8jTs.jsline 1 · col 7095
  • https://abs.twimg.com/x-web/x-web/assets/startup-vendor-JfxF0Mjo.jsline 21 · col 334801
  • https://abs.twimg.com/x-web/x-web/assets/startup-vendor-JfxF0Mjo.jsline 21 · col 334822
  • https://abs.twimg.com/x-web/x-web/assets/startup-vendor-JfxF0Mjo.jsline 29 · col 76200
  • https://abs.twimg.com/x-web/x-web/entry-client-logged-out-DB9qOn4u.jsline 2 · col 22241
navigator.webdriver2 calls
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 296030
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 7 · col 43814
navigator.webdriver3 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 296030
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 221871
screen.availHeight2 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 7 · col 27661
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 7 · col 27686
screen.availWidth2 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 245296
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 245321
screen.colorDepth3 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 2480
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 2245
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 2325
screen.height4 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 3105
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 296030
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 162868
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 162896
screen.pixelDepth1 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 296030
screen.width4 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 2336
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 1 · col 296030
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 82747
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 8 · col 82775
window.devicePixelRatio2 calls

Frame: https://x.com/

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 7 · col 31396
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsline 7 · col 31428
Scripts with both text drawing and canvas readback 1

These source URLs appear in both call groups. Aggregated logs do not preserve the full execution sequence or establish the purpose of the collection.

  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.js
Providers, script signatures, and DNS 0 provider labels

Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.

Static script signatures

  • https://abs.twimg.com/x-web/x-web/assets/_headerless-D3eB-MU3.jsArkose Labs · 0 API patterns
  • https://abs.twimg.com/x-web/x-web/assets/arkose-challenge-a7gR05Ki.jsArkose Labs · 0 API patterns
  • https://abs.twimg.com/x-web/x-web/assets/castle.umd-DpX19jpb.jsAPI patterns only · 6 API patterns
  • https://abs.twimg.com/x-web/x-web/assets/startup-dynamic-CLArY-jA.jsArkose Labs · 0 API patterns
  • https://abs.twimg.com/x-web/x-web/assets/use-jetfuel-dev-u0E4Nigt.jsArkose Labs · 0 API patterns
Network and worker observations 147 requests
Captured scripts
23
Instrumented frames
2
Google Ads observed
No
Transmission evidence
Not validated

Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.

Third-party hosts

  • abs.twimg.com
  • o30969.ingest.us.sentry.io
Other recorded API calls 3
  • document.cookie.read44 calls
  • document.cookie.write4 calls
  • webrtc.RTCPeerConnection2 calls
Source record and integrity
Original source
results/headful/x-com-20261019T061902.json
Original file SHA-256
3a17fd3316e8aa8f854fc97485e2aebac8e283ad61c9a17f42495e0d4535b875

Run ID: headful-3a17fd3316e8. The JSON contains sanitized observations, not the original private scan payload.

Other scan attempts (1)

Visitor setup

Not observed

0 of 5 signal families observed

Canvas: Not observedWebGL: Not observedAudio: Not observedFonts: Not observedDevice: Not observed
Measurement
Measured
Page context
Page document
Scan time
Not recorded
Browser / scanner
Unknown browser / Unversioned

Captured titleX. It’s what’s happening / X

CanvasDraws text and reads canvas output.1 API entries

Observed requires a text-drawing API and a canvas readback API. Guide ↗

canvas.getContext1 calls
  • Inline caller recorded
WebGLQueries the graphics environment.0 API entries

Observed requires at least three distinct WebGL probing APIs. Guide ↗

No matching API call was captured.

AudioRenders or reads audio samples.0 API entries

Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗

No matching API call was captured.

FontsMeasures text repeatedly.0 API entries

Observed requires at least ten text-measurement calls. Guide ↗

No matching API call was captured.

DeviceReads browser and display properties.0 API entries

Observed requires at least three distinct browser, screen, or window properties. Guide ↗

No matching API call was captured.

Providers, script signatures, and DNS 0 provider labels

Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.

No provider or DNS evidence in this record.

Network and worker observations 6 requests
Captured scripts
0
Instrumented frames
Not recorded
Google Ads observed
No
Transmission evidence
Not validated

Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.

Third-party hosts

  • abs.twimg.com
Other recorded API calls 1
  • document.cookie.read1 calls
Source record and integrity
Original source
results/headful/x-com.json
Original file SHA-256
23b6b00a3bdd78e1a787379f9e7906ee919b4874a47f08ba8ba8743da0f88b5f

Run ID: headful-23b6b00a3bdd. The JSON contains sanitized observations, not the original private scan payload.

Earlier measurement shown. Review the scan time and subsequent attempts below.

Research setup

Not observed

0 of 5 signal families observed

Canvas: Not observedWebGL: Not observedAudio: Not observedFonts: Not observedDevice: Not observed
Measurement
Measured
Page context
Page document
Scan time
2026-10-19T06:01:57.066976Z
Browser / scanner
156.0.8078.4 / 0.3
CanvasDraws text and reads canvas output.1 API entries

Observed requires a text-drawing API and a canvas readback API. Guide ↗

canvas.getContext1 calls

Frame: https://x.com/

  • Inline caller recorded
WebGLQueries the graphics environment.0 API entries

Observed requires at least three distinct WebGL probing APIs. Guide ↗

No matching API call was captured.

AudioRenders or reads audio samples.0 API entries

Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗

No matching API call was captured.

FontsMeasures text repeatedly.0 API entries

Observed requires at least ten text-measurement calls. Guide ↗

No matching API call was captured.

DeviceReads browser and display properties.0 API entries

Observed requires at least three distinct browser, screen, or window properties. Guide ↗

No matching API call was captured.

Providers, script signatures, and DNS 0 provider labels

Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.

No provider or DNS evidence in this record.

Network and worker observations 1 requests
Captured scripts
0
Instrumented frames
1
Google Ads observed
No
Transmission evidence
Not validated

Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.

Third-party hosts

    Source record and integrity
    Original source
    results/headless/x-com-20261019T060157.json
    Original file SHA-256
    67e28911972ed28f5a1162b48ae7df4d473376d8d5460ed05130032a34cc4dcb

    Run ID: research-67e28911972e. The JSON contains sanitized observations, not the original private scan payload.

    Other scan attempts (1)

    Research setup

    Not observed

    0 of 5 signal families observed

    Canvas: Not observedWebGL: Not observedAudio: Not observedFonts: Not observedDevice: Not observed
    Measurement
    Measured
    Page context
    Page document
    Scan time
    Not recorded
    Browser / scanner
    Unknown browser / Unversioned
    CanvasDraws text and reads canvas output.1 API entries

    Observed requires a text-drawing API and a canvas readback API. Guide ↗

    canvas.getContext1 calls
    • Inline caller recorded
    WebGLQueries the graphics environment.0 API entries

    Observed requires at least three distinct WebGL probing APIs. Guide ↗

    No matching API call was captured.

    AudioRenders or reads audio samples.0 API entries

    Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗

    No matching API call was captured.

    FontsMeasures text repeatedly.0 API entries

    Observed requires at least ten text-measurement calls. Guide ↗

    No matching API call was captured.

    DeviceReads browser and display properties.0 API entries

    Observed requires at least three distinct browser, screen, or window properties. Guide ↗

    No matching API call was captured.

    Providers, script signatures, and DNS 0 provider labels

    Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.

    No provider or DNS evidence in this record.

    Network and worker observations 1 requests
    Captured scripts
    0
    Instrumented frames
    Not recorded
    Google Ads observed
    No
    Transmission evidence
    Not validated

    Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.

    Third-party hosts

      Source record and integrity
      Original source
      results/headless/x-com.json
      Original file SHA-256
      0140457beb134606e3bbdae14897bba6defce1cbfdb8e1296278f74a3673e9e8

      The research mode is inferred from the archive folder because this legacy record has no mode field.

      Run ID: research-0140457beb13. The JSON contains sanitized observations, not the original private scan payload.

      Queries, request bodies, cookies, extracted values, raw errors, and session payloads are excluded before publication. The source digest identifies the original private record.

      Read the sanitized JSON →