What started as "why won't this IQ test show my score" turned into uncovering a multi-site scam operation with a shared backend, fake certificates, stolen questions, and years of victims across four different domain names.
I saw a Facebook ad for an IQ test called CogniProfile. I took it. My results were locked behind a $1.99 paywall. Something felt off, so I opened DevTools and started poking around.
Three hours later I had fully mapped the backend architecture of what turned out to be a network of at least four interconnected scam sites - all run by the same developer, all using the same questions, the same scoring engine, and the same dark patterns - operating continuously since at least 2021.
This is the full writeup.
| Site | Price | Status |
|---|---|---|
aptilink.io |
$10–$15 | Original - still active |
testmymind.net |
$15–$25 | Rebrand/clone of Aptilink |
cogniprofile.com |
$1.99 | Latest rebrand, running Facebook/TikTok/Reddit ads |
tws-audio.com |
$20 earbuds | Developer's origin project - hosts the scoring backend |
All four share the same infrastructure. The certificates issued by Aptilink are literally served from tws-audio.com - an earbuds dropshipping site.
CogniProfile advertises on Facebook as a free IQ test. You spend 30–40 minutes answering questions, then land on a results page showing:
- A blurred IQ score
- "Top 4%" badge
- High percentages across four cognitive categories
- A $1.99 "Unlock Full Report" button
Before even opening DevTools, red flags were everywhere:
- The "IQ score" shown was 888 - real IQ scales cap around 160
- "Top 4%" and all percentages are shown to every user regardless of answers
- Testimonial photos pulled from
i.pravatar.cc(a fake avatar service), random Twitter profiles, and one hotlinked from a Spanish nursing congress website - returning a 404 - Domain 7 months old, WHOIS hidden behind Icelandic privacy service Withheld for Privacy ehf
- ScamAdviser flagged the registrar as associated with a high number of low-trust sites
- Aptilink (the older version of this same site) has 150 Trustpilot reviews - nearly all 1 star, all describing the same hidden paywall pattern
Viewing page source revealed every "locked" value was already in the HTML, hidden with Tailwind CSS blur classes:
<p class="text-5xl font-bold blur-[10px]">888</p>
<span class="blur-[4px]">Top 4%</span>
<span class="blur-[4px]">94%</span>
<span class="blur-[4px]">87%</span>
<span class="blur-[4px]">91%</span>
<span class="blur-[4px]">89%</span>The blur is pure CSS. To remove it, open DevTools console on the payment page and run:
document.querySelectorAll('[class*="blur"]').forEach(el => {
el.className = el.className
.replace(/blur-\[[^\]]+\]/g, '')
.replace(/blur-\w+/g, '');
});The reveal is meaningless. 888 is hardcoded for every single user. The percentages are identical regardless of how you answer. None of it is calculated from your responses.
Before you even see the fake score, the site has fired:
- Google Analytics GA4 (
G-Q9P7WFCLLQ) - behaviour tracking - Google Ads (
AW-17711820366) - conversion tracking and retargeting - Facebook Pixel (
1298020535755936) - building Custom Audiences from test-takers - TikTok Pixel (
D4U35N3C77U1QNJ50S1G) - retargeting - Reddit Pixel - your hashed email address is sent here for cross-platform targeting
- ContentSquare (
928d2046b6447) - full session recording, capturing every mouse movement, scroll, and click
ContentSquare is enterprise-grade session recording software. They're actively A/B testing their conversion funnel on you. You are the product before you've handed over a penny.
The Next.js frontend is a hollow shell. Navigating to the results page with the Network tab open exposed the actual backend immediately:
GET https://cogniprofile-d36d8b7931ab.herokuapp.com/results/352022/ → 403 Forbidden
A Django application on Heroku. Everything interesting lives here.
Running JSON.stringify(localStorage) in the console dumped everything stored locally:
{
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"quiz_state": "{\"1\":{\"answers\":{\"2\":965,\"4\":19,...},\"durationSec\":2400}}"
}Two things immediately stood out:
- Quiz answers are stored entirely client-side. They never leave the browser during the test itself.
- The JWT decodes to a 10-year expiry (until 2036) - not standard practice.
{
"user_id": [REDACTED],
"iat": 1782396655,
"exp": 2097756655
}Using the JWT as a Bearer token against the Heroku backend:
| Endpoint | Status | Response |
|---|---|---|
/users/me/ |
200 | Full account data |
/quiz/1/ |
200 | Complete IQ question set |
/quiz/3/ |
200 | Personality test questions |
/quiz/5/ |
200 | ADHD screening questions |
/quiz/10/ |
200 | Paranoia/trust questionnaire |
/results/{id}/ |
403 | {"error": "Active subscription required"} |
/admin/ |
200 | Django admin login - publicly accessible |
/quiz/{large_id}/ |
500 | Unhandled server exception |
The 403 on /results/ returns proper JSON - the score exists in their database, it's just gated behind payment. Everything else was wide open through standard browser tooling.
The Django admin panel being publicly reachable at /admin/ is a misconfiguration worth noting.
The /quiz/1/ response contained the full question set. Every image URL pointed to an external domain:
{
"question_id": 6,
"src": "https://testmymind.net/images/questions/1_0_0.png",
"options": [
{ "src": "https://testmymind.net/images/questions/1_1_0.png" },
{ "src": "https://testmymind.net/images/questions/1_2_0.png" }
]
}CogniProfile isn't hosting copies of these images. They're hotlinking directly from TestMyMind's servers - consuming their bandwidth, with no permission or attribution.
Pulling TestMyMind's JavaScript bundle and extracting all hardcoded URLs revealed the original scoring backend:
$js = Invoke-WebRequest -Uri "https://testmymind.net/static/js/main.e6782ebc.js" | Select-Object -ExpandProperty Content
$js | Select-String -Pattern "https?://[a-zA-Z0-9\-\.]+" -AllMatches | ForEach-Object { $_.Matches.Value } | Sort-Object -UniqueOutput included:
https://tws-audio.com/iq/create
https://tws-audio.com/iq/new
https://tws-audio.com/iq/scorer
tws-audio.com is a static landing page for knockoff Bluetooth earbuds.
But buried in the search results came the real finding. A certificate URL appeared:
https://tws-audio.com/iq/new cert/cert.html?data=...&token=136
Fetching it returned:
IQ CERTIFICATE
Aptilink awards [name]
In recognition for successful completion of Aptilink certified IQ test
Score: 160
Aptilink IQ Test version 2.0
Certificate Serial Number: #1000000129437
Date: 13/11/2021
Aptilink - a completely different site - is issuing certificates hosted on the earbuds domain. This connected everything.
This isn't one scam site. It's a network that has been operating since at least November 2021.
tws-audio.com (earbuds dropshipping site - the developer's first project)
│
└── /iq/scorer.php ← the original scoring engine
└── /iq/new cert/ ← certificate generation, issued under "Aptilink" branding
│
▼
aptilink.io (the original IQ scam - active since ~2021)
│ 150+ Trustpilot reviews, nearly all 1 star
│ Same hidden paywall pattern
│ Same questions
▼
testmymind.net (rebrand - higher price point, $15–$25)
│ Same backend, same questions
│ Questions hosted here and hotlinked by cogniprofile
▼
cogniprofile.com (latest rebrand - $1.99, running paid social ads)
Next.js frontend, Heroku Django backend
5 tracking pixels on every visitor
CSS blur hiding hardcoded fake scores
| Site | Price | What you actually get |
|---|---|---|
| aptilink.io | ~$10–15 | A score from tws-audio.com/iq/scorer.php |
| testmymind.net | $15–25 | The same score |
| cogniprofile.com | $1.99 | The same score, probably |
The scores themselves are suspicious. Trustpilot reviews for Aptilink note that entire forum threads of users all scored either 136 or 141 - suggesting the results are generated within a flattering range regardless of actual performance. Someone reverse-engineered the Aptilink scoring endpoint in this GitHub gist, confirming the scorer lives at:
https://tws-audio.com/iq/scorer.php?answers=ANSWER_STRING&session_id=PAID_ID
A paid session ID is required to retrieve results - meaning even if you reconstruct your answer string, you can't get a score without a valid paid token.
The "IQ Certificate" sold by Aptilink and TestMyMind is a static HTML page hosted on tws-audio.com - an earbuds website - with a hardcoded score passed as a URL parameter. The score 160 in the example URL decodes from token=136 via a simple lookup. There is no issuing body, no psychometric validity, and no organisation behind "Aptilink certified" - it's a <div> on a Bluetooth earbuds product page.
Django's CSRF protection on POST requests was the one genuine security measure that worked correctly. Every attempt to submit data cross-origin was rejected. Everything else - the backend URL, JWT tokens, user IDs, full quiz content, account data, the entire question library - was accessible through standard browser tooling and PowerShell with no special skills or software required.
| Date | Event |
|---|---|
| Nov 2021 | First Aptilink certificate issued (serial #1000000129437) |
| ~2021–2023 | Aptilink operates, accumulates 150+ negative Trustpilot reviews |
| ~2023 | TestMyMind.net launched as rebrand at higher price |
| Nov 2024 | cogniprofile.com domain registered |
| Jun 2025 | Someone publishes Aptilink workaround gist on GitHub |
| Jun 2026 | CogniProfile investigated - this writeup |
- TestMyMind.net was contacted regarding the hotlinking and unauthorised commercial use of their content (before it was confirmed they are part of the same operation)
- Only my own account data was accessed at any point
- No data was modified, no systems were altered
- All testing performed with browser DevTools and PowerShell
- Chrome DevTools (Network tab + Console)
- PowerShell
Invoke-WebRequest - jwt.io for token decoding
- ScamAdviser and who.is for OSINT
- Trustpilot (150+ reviews confirming the pattern)
something didnt sit right with me from yesterday so I decided to go on at this for a bit longer, turns out my original suspicion was wrong :p, should be the final note of this.
June 2026 - started because of a Facebook ad, ended having mapped a four-site scam network that has been running since 2021.