FORESIGHT: How We Link Sessions Across Time and IP

Published: February 2026 | WHOX Research | R7

In brief: FORESIGHT links sessions via 18 signals across 4 categories. Network signals weigh 40%. GPU timing survives cookie wipes for months.

You Cleared Your Cookies. Congratulations. Utterly Pointless.

Every privacy guide on the web repeats the same incantation: clear your cookies, fire up incognito mode, maybe bolt on an ad blocker. You feel scrubbed. You feel invisible. You're neither.

Cookies were the tracking tech of the 2000s. Industry moved on. You didn't.

Modern websites spot returning visitors through signals that outlast cookie deletion, browser restarts, VPN swaps, and even hardware upgrades. Your GPU renders pixels in a way that's measurably yours. Your TLS handshake broadcasts your browser's identity before a single HTTP request wraps up. Your mouse moves with a cadence that is, statistically speaking, as personal as your handwriting.

A fingerprinting system can build a granular snapshot of any browser in one visit. One snapshot, though, is only half the problem. Harder question: have we seen this person before?

FORESIGHT answers that.

We're publishing the first public breakdown of the FORESIGHT algorithm, its two-stage Mosaic Linking system, the Digital Shadow profile it builds, and the machine learning pipeline it feeds. We're doing it because transparency isn't a liability. It's a competitive edge. Anyone can claim their system works. We're showing you how ours does.

A Brief History of Refusing to Forget

Advertising has never stomached the idea that a user might leave and come back unrecognized. Cross-session tracking's history reads like a chronicle of ever-more-inventive refusals to let go.

Evercookies: Tracking's Cockroach

In 2010, security researcher Samy Kamkar released evercookie, a JavaScript library that abused over a dozen storage mechanisms to keep a persistent identifier alive. HTTP cookies, Flash Local Shared Objects, Silverlight Isolated Storage, HTML5 localStorage, sessionStorage, IndexedDB, PNG cookies via canvas tag, HTTP ETags, Java Jnlp PersistenceService, Web SQL Database, IE userData, window.name, CSS history, web cache, and HSTS pinning. Version 0.4 beta wielded 17 in total. Clear all but one, and the survivor regenerated every sibling.

Cookie-respawning tricks like these surfaced on hulu.com, foxnews.com, and spotify.com through third-party analytics outfits like KISSmetrics, which used Flash cookies and ETags to resurrect deleted identifiers. Lesson the industry took away? Not stop tracking. Find methods users can't spot.

HSTS Supercookies: Weaponized Security

HTTP Strict Transport Security tells a browser to always use HTTPS for a given domain. Crafty implementers realized each subdomain's HSTS status could stand for one bit of a binary identifier. Visit a page, and 32 subdomains get selectively flagged, encoding a unique 32-bit ID into your browser's security policy. As Wikipedia notes, HSTS can be used to near-indelibly tag visiting browsers with recoverable identifying data.

HSTS state survived incognito mode in some browsers and wasn't swept away by standard clear-browsing-data actions. People who thought they were being careful were lugging around a tracking beacon sewn into their browser's own security plumbing.

TLS Session Tickets: When Handshakes Remember

TLS session resumption lets a server hand out a session ticket that the browser stores and presents on later connections, skipping the expensive cryptographic handshake. That ticket persists across HTTP requests and works perfectly well as a tracking identifier. Cookie deletion doesn't touch it. No browser privacy UI shows it. Sessions link even when cookies are blocked. One caveat worth noting: TLS session tickets live in the browser's TLS cache and get destroyed when the browser process closes. They don't survive restarts. Within a single browser session, though, they work flawlessly.

All three mechanisms share a common thread: they hijack browser features built for speed or security and repurpose them for identification. Each was found, publicized, and eventually patched by browser vendors. Every time one door shut, three more swung open.

Fingerprint Stability: What Sticks and What Doesn't

Core question FORESIGHT must crack: when a signal shifts between sessions, is it a new user or the same user with a fresh browser update?

A longitudinal study in PoPETs 2020 titled Long-Term Observation on Browser Fingerprinting tracked individual users over extended stretches and found the average stability of a full browser fingerprint sits around 1.8 weeks. After that, something shifts. Browser update. New font bundled with an app. Screen resolution tweak.

Average stability, though, hides enormous variance across signal types. Some signals are as fugacious as a browser version string. Others are welded to your hardware.

Signals that hold for months to years:

Canvas fingerprint. Bound to GPU hardware and drivers. Unless you yank out your graphics card or update your GPU driver, your canvas hash stays put. On the same hardware, it's stable for the life of the machine.
WebGL renderer and vendor. Hardware-tethered. Your GPU announces itself by name. Swapping an Nvidia RTX 3080 for an AMD RX 7900 changes it. Nothing else does.
Audio fingerprint. Shaped by the audio processing pipeline, a function of your sound hardware and OS audio subsystem. Shifts only on OS update or audio driver swap.
Hardware concurrency and device memory. CPU core count and RAM. Changes when you buy a new machine.

Signals that shift often:

User-Agent string. Updates with every browser release, roughly every four weeks for Chrome.
Font list. Changes whenever you install software that bundles fonts, common with creative apps.

Here's what matters: hardware signals persist far longer than software signals. Someone who clears cookies daily, rotates VPNs weekly, and updates their browser the minute a new version drops will still carry the same canvas hash, the same WebGL renderer, and the same audio fingerprint for months or years.

Cao et al. showed at NDSS 2017 that OS-level features like WebGL rendering, audio processing, and font enumeration can identify users even when they switch browsers entirely. Your GPU doesn't care whether you're running Chrome or Firefox. Renders the same way regardless.

FORESIGHT builds on that bedrock. Not all signals are equal. Some are ephemeral. Some are granite.

Mosaic Linking: Two Stages, One Picture

FORESIGHT uses a system we call Mosaic Linking. Name's deliberate. No single signal suffices. Arrange enough partial matches into a mosaic, though, and a picture crystallizes.

Stage 1: Signal-Based OR-Query

First stage weighs 18 signals across four categories. System doesn't need all 18 to match. Runs an OR-query: any signal match adds to the total weight.

Network signals carry 40% of total weight:

Signal	What It Grabs
JA4 signature	TLS Client Hello fingerprint: cipher suites, extensions, signature algorithms
H2 SETTINGS	HTTP/2 connection parameters: window size, max streams, header table size
Alpn	Application-Layer Protocol Negotiation preferences
JA4H	HTTP header order fingerprint

Network signals dominate the weighting for a reason that's both technical and strategic: they're the hardest signals to fake. JA4 and H2 SETTINGS are forged in the browser's compiled TLS and HTTP/2 stack. Changing them means modifying the browser at the source level, rebuilding it, and keeping those mods alive across updates. JavaScript-level API spoofing, the crutch most antidetect browsers lean on, can't reach these signals. A browser claiming to be Chrome 120 via its User-Agent string but presenting Firefox's TLS cipher suite order gets caught on the spot, and that mismatch itself becomes a linking signal.

Deep signals carry 30% of total weight:

Signal	What It Grabs
GPU timing hash	Statistical signature of GPU operation latency
WASM timing hash	WebAssembly execution timing profile
GC timing hash	Garbage collection pause pattern
Canvas worker hash	Canvas rendering in Web Worker context
WebGPU shader hash	Shader compilation fingerprint
RAF interval	RequestAnimationFrame timing characteristics
Math FP	Floating-point operation results

Deep signals are the hardware's autobiography. GPU timing mirrors your specific graphics processor's performance quirks. WASM timing captures how fast your CPU chews through compiled code. GC timing reveals the JavaScript engine's memory housekeeping on your particular hardware. None of these are configurable settings. They're emergent properties of silicon, as idiosyncratic as the whorls on a thumbprint.

Fast signals carry 15% of total weight:

Signal	What It Grabs
Canvas hash	Canvas 2D rendering fingerprint
Audio hash	AudioContext processing fingerprint
WebGL signature	WebGL renderer, vendor, extensions
Fonts hash	MinHash of installed fonts
WebGPU features	WebGPU feature bitmask
Screen signature	Resolution, DPR, color depth

Fast signals are the classic fingerprinting vectors, well-trodden in academic lit and actively targeted by privacy browsers. Brave farbles them. Firefox can randomize some. Safari adds noise in private mode. They still matter, but their reduced weight reflects their reduced trustworthiness in adversarial conditions.

Antidetect detection carries 7% of total weight:

When WHOX identifies the session as coming from a specific antidetect browser like Multilogin, GoLogin, Dolphin Anty, or any of the others it can classify, that classification itself becomes a linking signal. Two sessions from the same antidetect tool, bearing the same configuration artifacts, are more likely the same operator.

Stage 2: Behavioral Similarity

Second stage fires only when two conditions hold: Stage 1 must've produced a weight of at least 0.15, and at least two signals must've matched. A gate, not a default. Behavioral analysis is computationally heavy and noisy. Running it on every pair of sessions would churn out more false positives than useful matches.

When triggered, Stage 2 computes cosine similarity across behavioral vectors: mouse velocity distribution, acceleration patterns, and scroll speed. Adds 8% to total weight.

Research on ResearchGate confirms behavioral fingerprints stay consistent, drifting slowly over months to years. A separate study on session stitching from ScienceDirect in 2021 showed learned behavioral patterns from sequences of page visits can match sessions belonging to the same user even without stable identifiers. Optimal adversary performance showed up with 15 to 25 sessions before a discontinuity and 10 to 15 after.

We use behavioral signals as corroboration, not primary evidence. Someone's mouse movements alone aren't enough to pin them down. Someone whose GPU timing, canvas hash, and JA4 signature all match a prior session, and who also moves their mouse the same way? That's not happenstance.

Confidence Levels

Combined weight from both stages maps to four confidence tiers:

High confidence: Weight ≥ 0.35, with matches across two or more categories or a deep signal match. Strong link. Same hardware, same network stack, often the same behavioral cadence.
Medium confidence: Weight ≥ 0.15, with multiple signals from a single category. Likely the same user, room for doubt. Perhaps two machines with identical hardware configs.
Low confidence: Weight ≥ 0.05, with scant matching. Weak signal. Worth logging, not worth acting on alone.
Insufficient: Below all thresholds. No meaningful link found.

Thresholds are conservative by design. A false positive in session linking does more harm than a missed link. Telling a client two sessions belong to the same user when they don't erodes trust faster than any rival could.

Digital Shadow: Everything We've Seen About You

When FORESIGHT links sessions, it doesn't just spit back a list of matches. What gets built is a Digital Shadow: a composite profile drawn from everything WHOX has observed about an entity across all linked sessions.

Shadow contains:

Total linked sessions, unique IP addresses, countries observed, VPN providers used, browsers seen
Sessions where antidetect tools were spotted
First-seen and last-seen timestamps

Tracking Score

Tracking Score is a single number from 0 to 100 answering one question: how trackable is this user across the web? Computed from linked session count, IP address diversity, countries observed, and VPN usage patterns.

Someone with one session from one IP in one country scores low. Someone with 47 sessions across 12 IPs in 3 countries, hopscotching between three VPN providers, scores high. Not because they've done anything wrong. Because their digital wake is sprawling enough that any system running similar linking logic could stitch together the same profile.

Linkability Scores

Tracking Score is a headline number. Linkability scores are the fine print:

Fast linkability: How identifiable through classic surface signals? Canvas, audio, WebGL, fonts, screen.
Deep linkability: How identifiable through hardware timing signals? GPU, WASM, GC, shader compilation.
Network linkability: How identifiable through protocol-level signals? JA4, H2 SETTINGS, Alpn, JA4H.
Total linkability: Weighted blend of all three.

Scores tell the user where their exposure sits. Someone with high fast linkability but low network linkability might be running a stock browser without privacy shields but behind a well-tuned VPN. Someone with low fast linkability but high network linkability might be using Brave with farbling on but hasn't dealt with their TLS fingerprint. Scores are diagnostic. They point at what needs to change.

Data Value Estimate

FORESIGHT also reckons an estimated dollar value of the user's data profile. Not a price tag on a specific deal. An estimate of what an advertising profile with that level of granularity, that many linked sessions, that much behavioral and environmental data, would fetch on the open market.

Admittedly the most provocative number in the Shadow. Answers a question users seldom think to ask: what am I worth to the people tracking me?

Timeline: Your Session History Laid Bare

Timeline returns a chronological list of linked sessions with their matched signals. Each entry holds:

Timestamp
IP address, masked for privacy in the UI
Country and city
Browser identified
VPN provider, if spotted
Antidetect tool, if spotted
Specific signals that forged the match

Timeline makes the abstract visceral. Telling a user you're linkable across sessions is one thing. Showing them on January 14 you visited from a German IP running Chrome, and on January 19 from a Dutch IP running Firefox, and we know it was you because your GPU timing hash, canvas worker hash, and JA4 signature were identical both times. That lands differently.

Specificity like that turns a privacy tool into a privacy education.

Machine Learning Integration

FORESIGHT feeds three machine learning models, each trained on data drawn from the linking pipeline:

Binary Classifier

A LightGBM model trained on 57 numeric features to answer a single question: real browser or antidetect tool? Features are pulled from all three WHOX axes: fingerprint integrity signals, consistency checks, anonymizer markers.

LightGBM handles the heterogeneous, mixed-type feature sets browser fingerprinting throws up. Gradient-boosted decision trees manage missing values gracefully, which matters when not every browser supports every API WHOX queries.

Tool Classifier

Second LightGBM model, multiclass, trained to name which specific antidetect tool is in play. Multilogin. GoLogin. Dolphin Anty. And others. Each tool leaves telltale artifacts: specific patterns in prototype integrity checks, particular ways canvas or WebGL spoofing gets done, giveaway quirks in HTTP/2 behavior.

Naming the specific tool, rather than just flagging antidetect-or-not, lets Mosaic Linking use tool identity as a signal. Two sessions running the same version of GoLogin with the same configuration profile are likelier to be the same operator than two sessions running different tools.

Anomaly Detector

An Isolation Forest model running unsupervised anomaly detection. Safety net. Binary classifier catches known antidetect tools. Anomaly detector catches unknown ones, browsers and configurations that don't fit any established pattern.

Isolation Forest works by randomly partitioning data and measuring how quickly a given sample gets isolated. Anomalous samples, those that diverge sharply from the population, get isolated in fewer partitions. Needs no labeled training data, which means it can flag novel threats the supervised models have never encountered.

Why We Published All of It

Browser fingerprinting has a transparency problem. Companies tout accuracy rates without spelling out methodology. They promise 99.5% identification without disclosing what that number means, how it was gauged, or what befalls the remaining 0.5%.

We're publishing the FORESIGHT algorithm because we believe a fraud detection system should be auditable. Researchers studying browser fingerprinting now know exactly how our linking works. Privacy engineers building countermeasures know which signals we weigh heaviest and why. Potential clients sizing up vendors can compare our documented methodology against competitors who offer only marketing copy.

Call it naivety if you like. Publishing the algorithm doesn't make it easier to dodge. Signals FORESIGHT leans on, TLS fingerprints, GPU timing, hardware-bound rendering traits, can't be spoofed by reading a blog post. Spoofing them demands deep mods to the browser's compiled code, kept alive across every update, tested against every detection method. An estimated $2.3 billion antidetect browser market as of 2025 exists precisely because it's hard.

We'd rather compete on engineering than on obscurity.

What All of It Means for You

Regular person using a regular browser? FORESIGHT can link your sessions across IP changes, cookie wipes, and browser updates with high confidence, so long as you're on the same hardware. Your GPU, your audio pipeline, and your TLS stack identify you with a stubbornness that no amount of cookie clearing will shake.

Using a privacy-focused browser like Brave? You've trimmed your fast linkability. Canvas farbling and audio randomization make those signals less dependable. Network signals like JA4 and H2 SETTINGS stay untouched, though, unless Brave has overhauled its Chromium TLS stack. Deep signals like GPU and WASM timing are shaped by hardware, not software. Still there. Still yours.

Using Tor Browser or Mullvad Browser? You've done the most any browser can. Uniform fingerprints. Heavily curtailed WebGL, killed WebRTC, standardized screen dimensions, letterboxed windows. FORESIGHT will find precious few signals to match on. You're also browsing a web that increasingly buckles without the APIs these browsers disable.

Using an antidetect browser? FORESIGHT is built to spot your tool, name it, and use that classification as a linking signal. An estimated $2.3 billion antidetect market is an arms race, and we're on the detection side.

Honest answer? Perfect unlinkability on the modern web demands sacrifices most people won't make. Kill WebGL, WebRTC, and JavaScript. Use Tor. Accept that half the web will break.

Or accept that clearing your cookies was never the point. Your fingerprint isn't stored on your device. Your fingerprint is your device.

Sources

Kamkar, S. Evercookie. github.com/samyk/evercookie, 2010.
Wikipedia. HTTP Strict Transport Security: Privacy issues. en.wikipedia.org.
PoPETs 2020. Long-Term Observation on Browser Fingerprinting: Users' Trackability and Perspective.
Cao, Y. et al. Cross-Browser Fingerprinting via OS and Hardware Level Features. NDSS 2017.
ScienceDirect, 2021. Session stitching via behavioral pattern learning.
ResearchGate. Behavioral fingerprint consistency over longitudinal observation.
Joe12387. Browser Fingerprinting Resistance Research. github.com/Joe12387, updated Jul 2024.
JoinMassive.com. 10 Best Anti-Detect Browsers 2025. Anti-detect browser market size: $2.3 billion.
PoPETs 2025. How Unique is Whose Web Browser? popets-2025-0038.
WWW'25. Breaking the Shield: Analyzing and Attacking Canvas Fingerprinting Defenses in the Wild.
WHOX internal documentation. WHOX_CAPABILITIES.md, 2026.

FAQ

What is session linking and why should I care? Session linking is the craft of proving two separate browser sessions belong to the same person, even after cookie deletion, IP changes, and browser updates. FORESIGHT uses 18 signals across 4 categories to link sessions with high confidence. Clear cookies daily, rotate VPNs weekly, update your browser the instant a new version drops. Your canvas hash, WebGL renderer, and audio fingerprint stay identical for months. Session linking makes cookie clearing pointless.

How does FORESIGHT work? FORESIGHT uses two-stage Mosaic Linking. Stage 1 weighs 18 signals in an OR-query: network signals like JA4, H2 SETTINGS, Alpn, and JA4H carry 40% weight. Deep signals like GPU timing, WASM timing, GC timing, canvas worker hash, and WebGPU shader hash carry 30%. Fast signals like canvas, audio, WebGL, and fonts carry 15%. Antidetect detection carries 7%. Stage 2 adds behavioral similarity at 8%, but only when Stage 1 clears a threshold. Results map to high, medium, low, or insufficient confidence levels.

What survives a cookie wipe? Everything hardware-bound: canvas fingerprint tied to GPU and drivers, WebGL renderer and vendor, audio fingerprint tied to audio pipeline, hardware concurrency and device memory, GPU timing hash, WASM timing hash. Stable for the lifespan of your hardware. PoPETs 2020's longitudinal study found average fingerprint stability of 1.8 weeks overall, but hardware signals hold for months to years. Evercookie abused over a dozen storage mechanisms, but modern linking doesn't need stored data at all.

How stable are fingerprint signals over time? Varies wildly by signal type. User-Agent shifts every 4 weeks with browser updates. Font list shifts when you install software. Canvas hash, WebGL renderer, and audio fingerprint hold steady for months. GPU timing holds for the hardware's entire life. PoPETs 2020's Erlangen study tracked 1,304 users and gathered 88,088 measurements, finding 95%+ distinguishable with optimized attribute sets. FP-Stalker can track users through fingerprint changes by linking old and new prints through the stable core. Many hardware-bound attributes stay steady for months.

What is a Digital Shadow? Digital Shadow is the aggregated profile FORESIGHT builds from all linked sessions. Contains: total linked sessions, unique IPs, countries, VPN providers, browsers seen, antidetect tools spotted, first and last-seen timestamps. Computes a Tracking Score from 0 to 100 gauging cross-web trackability, linkability scores broken down by fast, deep, and network signals, and a Data Value Estimate in dollars. Timeline feature shows the chronological history of linked sessions with the specific signals that forged each match.