RB2B
RB2B Defeat Device - Bot Detection and Exfiltration Reversal (Greyout)
Parent Company: Retention.com
Summary
RB2B's JavaScript contains defeat device logic that detects compliance scanners, security tools, and automated browsers, then disables tracking functionality to appear compliant during audits while maintaining full surveillance for real users.
BTSS Score Breakdown
Technical Details
Code Evidence
Bot Detection Array #1 - Automation Tool Signatures
const BOT_DETECTION_1 = [
"ahrefssiteaudit",
"bingpreview",
"crawler",
"hubspot",
"mj12bot",
"petalbot",
"vercelbot",
"mediapartners-google",
"instagram",
"webdriver",
"geckodriver",
"beautifulsoup",
"insomnia"
];
Bot Detection Array #2 - Extended Signatures (50+ patterns)
const BOT_DETECTION_2 = [
"headlesschrome",
"cypress",
"phantomjs",
"selenium",
"chromedriver",
"scrapy",
"python-requests",
"postman",
"webdriver",
"puppeteer",
"playwright",
// ... 40+ more patterns
];
isBot Check Implementation
// Simplified from obfuscated original
function isBot() {
const ua = navigator.userAgent.toLowerCase();
return BOT_SIGNATURES.some(sig => ua.includes(sig)) ||
navigator.webdriver === true ||
window._phantom ||
window.callPhantom;
}
// Early exit if bot detected
if (isBot()) return;
Dynamic Code Execution - new Function()
// Enables runtime code generation - defeat device loaded dynamically
new Function(
[399,219,7,261,246,471,22,247,438,648,154,963,536,522,951],
()=>n(4857)
)
// Numeric arrays are string table indices for obfuscation
JOSE/JWT Encryption Library - Encrypted Exfiltration
// Full JOSE library for encrypted payloads
CompactEncrypt, SignJWT, EncryptJWT, jwtVerify, jwtDecrypt
// Supported algorithms (military-grade encryption for tracking data)
AES-GCM, AES-KW, ECDH-ES, RSA-OAEP, PBKDF2, Ed25519
// Auth state machine
LoginState: SUCCESS, INITIAL, FAILURE, EMAIL_VERIFICATION_REQUIRED
TokenRole: NONE, VISITOR, MEMBER
Poptin Behavioral Tracking Flags
// Cart abandonment and e-commerce surveillance
POPTIN_BROWSE_ABANDONMENT_PRODUCTS
POPTIN_FETCH_INITIAL_SHOPIFY_CART_FOR_FILTER
POPTIN_FETCH_INITIAL_SHOPIFY_CART
POPTIN_SHOPIFY_RECENT_PRODUCT_ID
// Session and page tracking
POPTIN_PREVIOUS_VISITED_PAGES_WITH_TIMESTAMP
POPTIN_CUSTOM_NEW_VISITOR_SESSION
// Cross-platform data sharing
DATA-FACEBOOK-SEND-TO-MESSANGER-PLUGIN
Network Evidence
https://ddwl4m2hdecbv.cloudfront.net/b/{CUSTOMER_ID}Primary loader - only executes if bot not detected
https://api.rb2b.com/identify{"visitorId":"...", "email":"...", "company":"..."}Person-level identification - blocked if bot detected
https://*.execute-api.us-west-2.amazonaws.com/b2bAPI Gateway deanonymization endpoint (exfiltration surface; Greyout strips intent fields here)
Attack Parallel: Volkswagen Dieselgate
VW's ECU software detected EPA dyno test conditions (steering wheel angle, ambient pressure, wheel speed sensors) and switched to a "compliant" emissions mode. Outside testing, the vehicles exceeded emissions limits by up to 40x. RB2B's script detects compliance testing conditions (automation tools, headless browsers, known scanner user-agents) and disables tracking. Outside testing, full surveillance operates including person-level de-anonymization. Both are "defeat devices" - software that detects regulatory oversight and alters behavior to appear compliant.
ReferenceFramework Mappings
Legal Touchpoints
Defeat devices constitute unfair trade practices. The deceptive nature of appearing compliant to auditors while surveilling users meets the FTC's unfairness standard: substantial injury, not outweighed by benefits, not reasonably avoidable by consumers.
Deceptive acts or practices in commerce. Representing compliance while actively evading compliance tools is textbook deception.
Unfair and Deceptive Acts and Practices statutes in all 50 states prohibit deceptive business practices. Defeat devices meet this standard.
Processing must be lawful, fair, and transparent. Defeat devices are the opposite of transparent - they are designed to hide true behavior from oversight.
Pre-consent exfiltration of hashed phone numbers constitutes collection of telephone subscriber information. Even hashed data is derived from PII and transmitted without prior express consent. Sites deploying RB2B inherit TCPA liability for this pre-consent phone data collection.
Prevalence
- RB2B's own website (rb2b.com)
- Numerous B2B SaaS companies
- Via white-label through Clay, Warmly
Reproduction Steps
## Reproduction Steps 1. **Visit rb2b.com** in a normal browser - Observe RB2B tracking loads and executes - Network requests to api.rb2b.com visible 2. **Visit rb2b.com** with Playwright/Puppeteer - Set `--headless` or let webdriver be detected - Observe RB2B script loads but tracking does NOT execute - No requests to api.rb2b.com 3. **Visit rb2b.com** with spoofed user-agent containing "selenium" - Observe same behavior - tracking disabled 4. **Deobfuscate the script** using Babel AST transformation - Extract bot detection arrays - Locate isBot() function and early exit logic
Remediation
Immediately remove RB2B script from all properties
Effort: trivialAudit other vendors for similar defeat device behavior
Effort: moderateImplement vendor contract clause prohibiting defeat devices
Effort: moderateReport to FTC if operating in regulated industry
Effort: significantIf GTM demands vendor retention, deploy Greyout to strip intent/referrer/pixel data while allowing IDs
Effort: moderate