How This Briefing Works
This report opens with key findings, then maps the gaps between what Weborama discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Weborama was observed loading and executing before user consent was obtained on 100% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Requires claims extraction via CDT”
Defeat device, behavioral biometrics, session recording, consent bypass, and fingerprinting detected in runtime
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Weborama
- →Audit defeat device deployment within audience intelligence infrastructure
- →Review session recording scope in targeting workflows
- →Verify fingerprinting boundaries for audience continuity mechanisms
- →Require consent collection before Weborama tracking initialization
If You're Evaluating Weborama
- →DSP solutions without embedded visitor surveillance beyond ad delivery
- →Privacy-respecting audience platforms limiting tracking scope
- →Contextual advertising eliminating behavioral profiling and cross-customer intelligence leakage
Negotiation Leverage
- →Challenge defeat device mechanisms within advertising infrastructure
- →Require disclosure of all surveillance capabilities beyond audience intelligence
- →Demand opt-out from cross-customer audience monitoring analysis
- →Request data processing agreement amendments addressing visitor tracking through DSP platform
- →Negotiate liability protection for consent violations by audience intelligence infrastructure
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Impact: Detection evasion mechanisms obscure tracking deployment within audience intelligence infrastructure.
Keystroke/mouse tracking
Impact: Interaction patterns captured to enhance audience profiles and improve targeting precision.
Full session replay
Impact: Website sessions captured to contextualize audience behavior and optimize segmentation strategies.
Ignoring CMP signals
Impact: Tracking mechanisms active through advertising infrastructure before visitor consent collection completes.
Device identification
Impact: Device characteristics harvested for audience continuity across campaigns and publisher networks.
IOC Manifest
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
101 detection signatures across scripts, domains, cookies, and network endpoints