build an open-source cloaker strategy?

Hey guys,

I probably have NO IDEA what I'm talking about, but I'd like to ask the BHW a very technical question regarding these mysterious cloakers that I keep hearing reference too?

My understanding is it goes something like this: I have links that I want to put into facebook or other social media ads but maybe my product or industry isn't approved for marketing on those platforms... so my ads never get run or approved... So i want to run my ads with these 'cloaked links' so that when someone who works from facebook clicks the link they see landing page #1 and when someone who doesn't work from facebook clicks the links they see landing page #2. Is that the correct understanding / definition for this tool?

This doesn't sound a whole lot different than conditional a/b testing, my question is when trying to build something like this: what logic gets applied on the h.t.t.p requests on the server-side to analyze where the request is coming from and determine who is viewing your link and which landing page to show them...?

do you somehow get user data from the facebook pixel to verify real user? keep a blacklist of facebook's office's IP's? find a way to filter out bot requests by headers? somehow analyze the refferer link and filter for certain conditions? what are those?
Is it just done by randomly showing a percentage of your traffic a different page once the ad is running?

I've built a lot of webscapers and some webapps in the past and feel like someone must have open-sourced an implementation of this i know we aren't encouraged to post live links but if anyone thinks they have some code i can checkout or an idea that might help me understand how this works better?

Newbie here just tryna level up, thanks a lot for your time my fellow hats
-Greenhatt

You are almost right, but there few things for which you need to spend good amount, like IPs etc

Nut-Nights said:

You are almost right, but there few things for which you need to spend good amount, like IPs etc

Click to expand...

What do use the IP's for? Can you elaborate on the behaviour please? Are you saying need separate dedicated IP's hosting both versions of landing page and then redirect one to the other?
Thanks for letting me know on right track...

Green Hatt said:

What do use the IP's for? Can you elaborate on the behaviour please? Are you saying need separate dedicated IP's hosting both versions of landing page and then redirect one to the other?
Thanks for letting me know on right track...

Click to expand...

don't expect any help nut-nights posts in almost any thread related to cloaking just to promote the crappy cloaker in his signature
he probably referred to IP lists of bots that you need..

Hey @itz_styx, I have lists of IP's a bots, I've used them with programs like scrapebox before, do i need to set up a redirect chain of a certain size and forward a portion of my traffic to the cloaked url? i appreciate your contribution to my quest regardless.

There no reason why one would make a cloaker open source. FB can inspect the code and update their anti-tracking technique accordingly, defeating the code target.

thank you @thetraveller, you make a valid point. but how is facebook inspecting code that exists on landing page #1's server side that's forwarding a percentage of traffic to landing page #2? is there a tracking-code in the refferal link that the user clicks on the ad on fb platform and somehow tells facebook what the final destination of the redirect chain is? appreciate you sharing more of your thoughts, they are contructive.

thetraveller said:

There no reason why one would make a cloaker open source. FB can inspect the code and update their anti-tracking technique accordingly, defeating the code target.

Click to expand...

Can you elaborate on 'Anti-tracking technique' pls? I do not understand the context of anti-tracking that you used

The server-side code can't be inspected from the outside, it does the magic internally and only accessible by the administrators, that's why these kind of solutions are private/closed-source. Once you have an open-source solution, then it can be inspected to the root. Having access to that sensitive information, anyone can quickly fabricate countermeasures to close access to their weak point - that's what I meant with anti-tracking (by upgrading their crawler characteristics in new ways, they will block the actual tracking of their crawler, making the cloak technique useless).

thetraveller said:

The server-side code can't be inspected from the outside, it does the magic internally and only accessible by the administrators, that's why these kind of solutions are private/closed-source.

Click to expand...

Okay sure. i write serverside code and facebook can't see it. i can write logic to forward a small subset of my traffic to somewhere else (possibly based on request headers trying to identify a fb bot vs a real fb user) So eventually i might accidentally redirect a fb crawler to my #2 landing page and that'd be a no-no, id get account and platform ban, have to repeat process with another identity as proxy, etc etc

thetraveller said:

Once you have an open-source solution, then it can be inspected to the root. Having access to that sensitive information, anyone can quickly fabricate countermeasures to close access to their weak point - that's what I meant with anti-tracking (by upgrading their crawler characteristics in new ways, they will block the actual tracking of their crawler, making the cloak technique useless).

Click to expand...

Interesting. So fb has bots aka crawlers that randomly go through the links in their ads and try to catch people with serverside redirect chains forwarding fb platform traffic elsewhere than intended ad page. I'm still fuzzy on the meaning of anti-tracking here, it seems like fb bots ARE trying to track my ad's links end-point. why would they upgrade their crawler characteristics to block the tracking of their crawler when that their whole goal? Maybe you just meant: if you opensource your server code your a goof cuz fb will 100% update their crawlers and make THAT implementation less effective / useless. But wouldn't you still have SOME time on the networks running ads? How instant can their inforcement be?

Anyone got a nice account ban or warning or cease and desist court-order story they'd like to share?

"So eventually i might accidentally redirect a fb crawler to my #2 landing page and that'd be a no-no"
That's the thing where cloakers should excel, making sure automated (and some manual inspection) traffic is properly taking care of.
If cloakers are good at what they do, most of the FB ads accounts are banned by manual inspection, from which the cloaker can't predict header and IP source.
I believe these days FB does not inspect ads from their headquarters with FB-owned IP's. So they might use a rented dsl connection or have some secret sources in-house anyways. (If they didn't, ppl would not report so many banned accounts, or their chosen cloakers didn't get their job well in blocking automated inspection)

"why would they upgrade their crawler characteristics to block the tracking of their crawler when that their whole goal?"
The crawler scope is to detect and take note on links and what it found on pages, not to be detected and avoided by cloakers.

"But wouldn't you still have SOME time on the networks running ads? How instant can their inforcement be?"
Of course you get some time till networks makes update, but you never want to show them your tricks naked.

If we make a open-source cloaker then big organizations just have to inspect the openly available source code and they will be able to adjust their tracking code and beat the cloaker.

unfortunatly free cloaking will be useless becouse once someone no how it works then it can be blocked .

hope you understand .

a real cloak use ip address and website links to bounce of to stop it being pulled down .

the ip are known ip from big websites and cost a lot.

only those in the cloak business are using such ip databases .


there a really good one i use and loads do and cheap.

it only cheap becouse many use.

""wp profit"" there a bst on here ...

This will end in the same cat and mice game like the instagram botting. You will build a genius cloaker with blacklisted Facebook/Ads IPs, they will use proxies to recheck, you will add proxies, the will use residential/mobile proxies, you will check for browser/Resolution/useragent they will rotate these setting,...
It is much harder to get rid of different individual cloakers than of one.