I Deobfuscated a Scam: How bunnyband.com Fingerprints and Tracks Its Users
A friend asked me to check if a reward website was legitimate. A JavaScript deobfuscation session later, I had uncovered a geofenced fingerprinting operation collecting 34 device data points per visitor, a hidden auto-submitting form, and infrastructure already flagged by multiple DNS threat feeds.