One address, twenty-three saved records: what a spyware check found on this Mac 1

The result

What “contacted” means here

All 23 matches carry the evidence grade contacted. The tool defines that grade as: the device demonstrably talked to it (a cookie it set, a secure-connection record, a download from it). 5 In this case the record is a cookie: each match is a cookie named server_tracking_bdsp_uid (the name the advertising network gave it) that the address set in a browser profile on this Mac. 1

A match is evidence that needs interpretation by a qualified person. Read each finding's evidence grade: only a match of a known spyware file on disk is conclusive.

Advertising-network records alone do not show that you were selected for an exploit or infected. A connection can result from an ordinary ad.

Zero Breach Toolkit, in its required relay text and its human report 3

The tool's reporting code says the same thing in one line: The verdict for a hit is “investigate”, never “you are compromised” — an ad impression is not proof of infection. 3 So the honest reading of this page is: something on this Mac contacted infrastructure a published investigation lists as spyware delivery, and that is worth a person looking into. It is not a finding that spyware is installed.

The five things the tool requires anyone to pass on

The report carries five statements it says must be relayed in full. They are copied here without editing. 1

1. This tool only looks for publicly documented indicators of known spyware. It cannot detect new or unpublished spyware, and the traces this spyware leaves usually expire within weeks.
2. Do not delete, move, open or 'clean' the matched files or records. Keep the device and this report as evidence.
3. A match is evidence that needs interpretation by a qualified person. Read each finding's evidence grade: only a match of a known spyware file on disk is conclusive.
4. Some checks could not run (listed under not_checked). Nothing was cleared in those places.
5. Only the small built-in indicator set was used. The larger published sets were unavailable for this scan (missing, unreadable or refused). Run --update, review the source status, then scan again.

Two terms in those statements: not_checked, the report's own name for the list of checks that could not run, is the list in the gaps section below; and --update, a switch the toolkit is started with, downloads fresh indicator lists from the published sources before a scan. 3

What the scan actually looked at

The scan started 28 Oct 2026, 02:21 and the report was closed on 2026-10-28. 1 Four modules ran on this Mac: browser records, file hashes, the hosts file, and Unix startup and log files. Each module reports how much it read and how long it took.

How far back the records reach

The browser module found the oldest surviving web trace dated 2025-01-25, which is 640 days before the scan. Cookies reach back the same 640 days across 105 cookie stores. 1 That is the oldest record that survived, not a continuous log: the tool's own note says the web cache is recycled within weeks, and that this date is often much older than the cache alone. That is why a date from 2025 can sit in a cookie found in 2026.

The honest oddity of browser evidence: page history reaches back further than the cache, but history records only page visits, and an ad loads inside a page. The tool puts it plainly: the long record cannot see ads, and the record that sees ads is not long. 1 The 23 matches come from the short, ad-seeing record.

The records, grouped

Read the 23 matches together and they are one thing, seen nine times: one address, tracookiepixel[.]xyz, saved as cookies in 3 browser apps across 9 moments between 2025-08-22 and 2026-09-03. 1 The tool counts 14 distinct artifacts behind those 23 records: the same cookie turns up in more than one profile, and repeated copies do not strengthen the result. 1

Every row, as the report lists them

Timestamp, address, evidence type and module are the report's own fields. The last column is the app and profile the record was saved in, shortened from the report's file path; the path itself is not published here because it names this Mac's home folder.

The tool asks that indicator addresses be shared with the dot in brackets, as written here, so a reader cannot click through to them by accident. Do not visit or look up the address to investigate it. 3

The checks the browser module ran

The browser module lists 159 named checks: 158 ran and 1 could not. 1 This is the tool's own list, searchable here in your browser, and nothing is added to it. Checks marked cookie store are the 44 checks that read the kind of record all 23 matches came from. Checks marked hit app are the 18 checks that read one of the three apps where those matches were saved: Chrome, ego lite and Dia (the tool lists ego lite as citro labs). The tool does not mark a single check as the one that produced a match, so these are its own check names, grouped, and nothing else is claimed.

The list shows one page of matching checks at a time, which keeps the page small on a phone; the search box narrows the rest from the whole list. A check name ending in :cookies means that app's cookie store was read.

What could not be checked

The scan is marked partial, and it ends with exit code 2, which means matches were found. 1 But the 34 listed gaps below are why a reader must not read this page as a clean bill of health. Nothing was cleared in the places listed below.

Home-folder paths in the quotes above are shortened to ~; the wording is otherwise the report's own.

Sources and the tool's own limits

Every figure on this page was read from the machine report of one finished scan. The table names, for each source, where it comes from and what it backs. The report also carries a 64-character check code over its indicator set, starting ae4dcd5a66bf5fa1, so a copy of the report can be compared against this one. 1

The limits, in the tool's words

This tool only looks for publicly documented indicators of known spyware. It cannot detect new or unpublished spyware, and the traces this spyware leaves usually expire within weeks.

A scan makes no intentional network requests and has no upload feature.

Zero Breach Toolkit, required relay text and PRIVACY.md 6

• “Read-only local evidence; no infection-free guarantee.”
• “File hashing remains bounded to 120 MiB per file.”
• “Full means broader checks in the usual roots, not every drive or every user.”

Those three lines are the report's own scope limits, copied unchanged. 1

What this page does not say

It does not say the Mac is clean: 34 gaps and a partial scan rule that out. It does not say the Mac is infected: a contacted match is a weak grade, and the tool's own words are that only a known spyware file on disk is conclusive. It reports what was found, what was read to find it, and what was left unread. 3

Words used here

DNS record

A saved name lookup: the record that a name was asked for, which does not show whether anything answered.

MVT

The Mobile Verification Toolkit, a published phone-forensics tool that keeps lists of spyware addresses.

POSIX

The standard interface that Unix-like systems such as macOS share.

SQLite

A database kept in one file; browsers use it for cookies, history and saved site data.