1. Advanced cloaking service providers offers a sort of machine learning (ML) filtering. I won't get into details of the technology itslef but just mention that in order to use such a filter one needs to analyze user behavior in real time, as mouse moves, scrolling etc. These categories are use as classifiers and the feature predicts if a user agent is or not human. The data may be sent to cloaking provider via an api using most likely ajax. Ajax is in fact javascript and by simply monitoring user behaviour gets uncovered. Client side scripting cannot be captured directly into a server side language, because of several reasons.
2. A simpler filter of js can be put in place without ML, by simply detecting some ja specific acrivity, but - apart a better response time - the downside of disclosing the script is the same as for ML.
3. A good cloaker is a good cloaker, you don't set it for specific cimpany, that's pure marketing. But this doesn't mean any cloaker doesn't need a specific tune up before a specific canpaign, traffic needs to be analyzed and thus tying to isolate the provider's network fingerprint, this is the real set up.
This is the context in which I had the idea of hiding all javascript from bots, in spite of still being able to use it for detection (I know, it sounds silly but is doable).
Instead of conclusion, it's not my fault if I provide important hints that some users cannot understand for whatever reason.
//edit: I had forgotten: there is not such thing as infailible cloaking technique, the most powerfull feature is the use of ML, but that's tricky as well.
