I’ve been tracking some highly targeted phishing operations that use a third-party service to identify and fingerprint their victim(s) using “handsetdetection(.)com”. Spoofing the browsers useragent string is not enough to trigger exploitation because of this “service”.