Technique

ISP Data Harvesting

Also known as: ISP Surveillance, ISP Data Collection, Supercookie Tracking, UIDH Tracking

TARGETING

Exploitation of an Internet Service Provider's privileged position in the network to collect, aggregate, and monetize subscriber data. ISPs can observe all unencrypted traffic, DNS queries, connection metadata, and browsing patterns. Techniques include deep packet inspection (DPI) to analyze packet…

Common attack flows

How it fits in a scam

This technique shows up duringTARGETING

Before

This is often where the scam begins.

After

Defense

How to defend against this

How to spot it

  • Unexpected targeted ads based on private browsing activity not shared on social media
  • Receiving marketing from third parties related to obscure or niche browsing topics
  • ISP privacy policy changes or opt-out notifications indicating new data-sharing programs
  • Presence of injected HTTP headers (X-UIDH) visible in network traffic analysis
  • Personalized scam contacts referencing specific ISP subscription details

Tools you can use

Steps you can take

Further reading