Grumbles 🦴
17 posts
Grumbles 🦴
@Fournscorn
22 gay mexican nothing else here, minors dni
Inside your mom Katılım Şubat 2026
15 Takip Edilen8 Takipçiler
go check out bigfurrybuttz.com
Remember to share the site with others :3
English
no he podido dibujar cómodo durante estos días y es que es por que en mi país hay un calor que no se soporta y mi tableta parece parrilla y me llega a calentar feo la mano jajaja, dibujo durante la tarde o noche y eso lo hago con los pedidos que estoy haciendo.
Español
Grumbles 🦴 retweetledi
@kibblemayo Don’t they have any telemetry cookie banners or anything at all??
English
Concerns about underpa.ws (underpaws website)
i was looking though the minified js code and network tab and found it was sending a POST request to an api. SO i checked deeper and found 3 post requests that are concerning...
Step/interaction tracking (POST /api/stats/step) fetch(${Rb}/step, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
sessionId: No,
pawShape: e,
count: i
})
})
Time-on-site tracking (POST /api/stats/time) fetch(${Rb}/time, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
sessionId: No,
seconds: i,
pawShape: e
})
})
Behavioral profiling / bot report (POST /api/bot-report) fetch("/api/bot-report", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
score: pa,
reasons: Nb, stepsBeforeCatch: Gr.length,
sessionId: sessionStorage.getItem("session-id") || null })
})
Continuous polling (every 60s)
setInterval(() => { af(Uo, Ts, true) }, 6e4) // af() calls: fetch(/api/stats/history?range=${i})
Base URL:
const Rb = "/api/stats";
The site silently tracks every user interaction (step count) and time spent on the page, tied to a persistent sessionId.
A behavioral profiling system scores user behavior (score, reasons) and
reports it to /api/bot-report, also tied to their session.
A 60-second polling loop continuously communicates with the server while the page is open.
All of this happens with no visible user consent mechanism in the code, no cookie banner, no opt-in, no privacy disclosure was found in the bundle. No direct IP harvesting in the JS, but the server gets IPs naturally
from every request. There is active browser/GPU fingerprinting that gets reported to their backend.
English
@Fournscorn They gain egos that nobody cares about :3
English
