All Vendors
deanon

Warmly

Warmly triggers 8 BTI behavioral codes — the most of any vendor in this analysis group — including real-time data exfiltration via WebSocket, and carries the highest signal corruption score (70) in the VRS 85 tier.

27 IOCs21 detections33% pre-consent8 sites
85
Vendor Risk Score

How This Briefing Works

This report opens with key findings, then maps the gaps between what Warmly discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.

Key Findings

Key Findings

21 detections across 8 sites33% pre-consent activity
HIGH

Pre-Consent Activity

Warmly was observed loading and executing before user consent was obtained on 33% of sites where it was detected.

GDPRePrivacy
HIGH

Pending Analysis

8 BTI behavioral codes detected across 21 observations on 8 sites. Full claims extraction required for gap analysis.

HIGH

Compliance Claim Mismatch

False certification claims

HIGH

Assurance Gap

Gated or missing due diligence docs

Disclosure Gaps

Claims vs. Observed Behavior

1 gaps
1 HIGH
Classified:BTI-X05BTI-X12

Pending Analysis

HIGH
They Claim

Claims analysis pending

Observed Behavior

8 BTI behavioral codes detected across 21 observations on 8 sites. Full claims extraction required for gap analysis.

Customer Impact

What This Means For You

If Warmly is on your site, your visitors are being identified in real time and their data is streaming off your property via WebSocket connections as they browse. With 8 BTI-C codes triggered — the most of any vendor in this group — Warmly represents the most behaviorally aggressive deanonymization tool we have observed at this risk tier. The real-time exfiltration (C16) means visitor data leaves your site before you could intervene even if you detected it. Your signal corruption score of 70 means your first-party analytics are significantly compromised whenever Warmly is active. Under GDPR, the combination of deanonymization, consent bypass, and real-time data transfer to a third party creates compounding liability that cannot be addressed through privacy policy updates alone.
Recommended Actions

What To Do About It

Role-specific actions based on observed behavior

If You Use Warmly

  • Implement network-level monitoring for WebSocket/SSE connections to Warmly domains — standard request logging will not capture real-time exfiltration
  • Block Warmly from firing until explicit, informed consent is obtained specifically for visitor deanonymization and real-time data streaming
  • Conduct a DPIA covering Warmly's 8 BTI-C behaviors — this density of detection requires formal privacy impact assessment under GDPR Article 35
  • Audit your first-party analytics with Warmly disabled versus enabled to quantify the signal corruption impact on your measurement stack

If You're Evaluating Warmly

  • Assess whether any deanonymization tool warrants the regulatory exposure created by 8 concurrent BTI-C code triggers and real-time data exfiltration
  • Request Warmly's technical documentation on exactly what data is transmitted via WebSocket and to which endpoints
  • Evaluate whether intent-based lead scoring from first-party signals could replace deanonymization without the compliance burden
  • Consider that Warmly's signal corruption score (70) means your analytics integrity is compromised whenever the tool is active — factor this into ROI calculations

Negotiation Leverage

  • 8 BTI-C codes triggered — the most of any vendor in this analysis group — including real-time exfiltration (C16) that makes data streaming invisible to standard monitoring
  • Signal corruption score of 70 is the HIGHEST in the entire VRS 85 tier — Warmly measurably degrades your analytics integrity
  • WebSocket/SSE exfiltration (C16) means visitor data leaves your site in real time before any intervention is possible — demand disclosure of all WebSocket endpoints and transmitted data fields
  • 4 domains and 5 scripts for 8 sites — the infrastructure-to-deployment ratio suggests heavy instrumentation per site
  • Demand a consent-first mode, WebSocket data inventory, and contractual prohibition on cross-customer data aggregation as minimum conditions for continued deployment
Runtime Detections

Runtime Detections

8 BTI-C CODES

BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.

BTI-C01Defeat Device

Evasion infrastructure, auditor bypass

Impact: Warmly deploys evasion infrastructure capable of modifying its behavior during audits or compliance checks. Combined with 7 other BTI-C triggers, this suggests systematic awareness of and adaptation to detection mechanisms.

BTI-C06Behavioral Biometrics

Keystroke/mouse tracking

Impact: Behavioral tracking feeds Warmly's AI-powered identification models. Mouse movements, scroll patterns, and interaction sequences are captured and processed to enhance visitor identification accuracy beyond what network-level signals alone provide.

BTI-C08Cross-Domain Sync

Identity stitching

Impact: Identity stitching across Warmly-enabled sites means visitor profiles are built from behavioral data aggregated across multiple properties. Your site contributes to a cross-domain identity graph controlled entirely by Warmly.

BTI-C09Consent Bypass

Ignoring CMP signals

Impact: 33% pre-consent firing rate means one-third of observed Warmly deployments begin deanonymization before consent mechanisms engage. For a tool whose primary function is identifying people, any pre-consent activation creates immediate GDPR liability.

BTI-C10Fingerprinting

Device identification

Impact: Device fingerprinting enables persistent identification across sessions and cookie resets, ensuring Warmly's deanonymization survives standard privacy measures and maintains continuous visitor tracking despite user privacy actions.

BTI-C14Identity Resolution

PII deanonymization

Impact: Deanonymization is Warmly's core product — resolving anonymous visitors to real company and individual identities. Every visitor on your site becomes a lead record in Warmly's system, identified and enriched in real time without visitor knowledge or consent.

BTI-C15Tag Manager

Container/loader (neutral)

Impact: Container/loader behavior allows Warmly to dynamically load and orchestrate its multi-script deployment across 4 domains, potentially introducing additional tracking capabilities without requiring host site code changes.

BTI-C16Real-Time Exfiltration

WebSocket/SSE streaming

Impact: WebSocket/SSE streaming detected — Warmly transmits visitor data off your site in real time as users browse. This is not batch collection for later processing; it is live data streaming that makes exfiltration invisible to standard request-level monitoring and impossible to retroactively prevent.

IOC Manifest

IOC Manifest

22 INDICATORS

Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.

TRACK
*www.warmly.ai/cdn-cgi/challenge-platform/scripts/jsd/main.js*
Tracking script
TRACK
*www.warmly.ai/cdn-cgi/challenge-platform/h/b/scripts/jsd/*/main.js*
Tracking script
TRACK
warmly-script-loader
Tracking script
TRACK
widget-DB0I63WS.js
Tracking script
TRACK
www.warmly.ai/cdn-cgi/challenge-platform/scripts/jsd/main.js
Auto-extracted from scan
TRACK
www.warmly.ai/cdn-cgi/challenge-platform/h/b/scripts/jsd/d251aa49a8a3/main.js
Auto-extracted from scan
Ecosystem

Ecosystem & Supply Chain

Warmly competes in the rapidly growing visitor deanonymization market alongside RB2B, 6sense, Clearbit, and Demandbase. It integrates with Salesforce, HubSpot, Outreach, and Slack, feeding real-time visitor identifications into sales workflows. Warmly's AI positioning differentiates it from simpler reverse-IP lookup tools by incorporating behavioral signals, firmographic data, and intent scoring. Its 4-domain deployment footprint suggests a distributed infrastructure designed to maximize data collection coverage while distributing its network presence across multiple origins.
Evidence

Evidence Artifacts

Artifacts collected during analysis, available with evidence-tier access.

HAR Capture

Complete network capture with all requests and responses

IOC Manifest

27 detection signatures across scripts, domains, cookies, and network endpoints

HAR Forensics

HAR Forensics

Email Hash Exfiltration (3)
DestinationAlgorithm
Vendor Details