Skip to content

Instantly share code, notes, and snippets.

@ACK-J

ACK-J/metrix_block.py

Last active July 17, 2023 20:03
Show Gist options
  • Star 4 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save ACK-J/7a2da401c732cbe58479d03acc4e4b43 to your computer and use it in GitHub Desktop.
Save ACK-J/7a2da401c732cbe58479d03acc4e4b43 to your computer and use it in GitHub Desktop.
Download ZIP
Find all the domains ThreatMetrix is using to exfil user tracking data
Raw
metrix_block.py
from shodan import Shodan
api = Shodan('API-KEY')
results = api.search('isp:"ThreatMetrix Inc." port:443 Bad Request')
for banner in results['matches']:
# Only care about services that use SSL
if 'ssl' in banner:
print(banner['ssl']['cert']['subject']['CN'])
@ACK-J
Copy link
Author

ACK-J commented Mar 27, 2021

image
You can paste the output into uBlockOrigin to prevent being port scanned and tracked

@ACK-J
Copy link
Author

ACK-J commented Apr 28, 2021

This script only uses 3 pieces of information (org, port, HTML text) to find a majority of the Threat Metrix backend infrastructure, imagine how well they can fingerprint your browsing habbits across the web with the 416 pieces of information they gather about your network / browser 🤔

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment