Cloakers | And why sometiems they don't work.

Elegante

Elegante

Regular Member
Joined
Jul 6, 2015
Messages
429
Reaction score
153
most of these common cloakers work off basic stuff—IP score, user-agent, referrer, maybe some light JS fingerprinting. they run a quick check through PHP or JS, then redirect bad traffic to a clean page and good traffic to the offer or whatever. sounds solid… but it’s shallow af.
I mean it works but its kind of not that good .

( that's why people have custom solutions most of the time according to their needs) : )

Analytics gets shared from different services application in ur shopify wordpress chrome etc to these big service providers (google meta etc.)
But here’s the issue—these checks (in cloakers) don’t cover all the hidden behaviors, right? While they might block obvious bots based on IP or user-agent, they ignore deeper telemetry stuff that browsers send back. Google can track everything, from mouse movements to hidden browser calls, and that’s where these simple cloakers fall short.

Google and others got its own suite of telemetry and analytics systems that report on how a page is rendered, including DOM tree changes, element visibility, and user interaction patterns. php and js scripts are too predictable now.

It’s like trying to run a marathon with a broken sneaker
 
Advertise on BHW
This telemetry of the proprietary browsers has concerned me for a long time. However, spying on users' behaviour is illegal and falls under GDPR penalty in Europe. In reality, owners of the browsers have limited access to users' activity. For apps, the situation is slighly different, in the sense that they can spy deeper into behaviour.
On the other hand, php and js can do a lot in order to mask things. JS can see very deep into visitors machines and accurately spot bots and unusual activity. So wisely used, some js can be part of a robust traffic tracking. The problem is that, when js calls cross domain scripts, becomes vulerable.
I have noticed that above medium bots analyze javascript and then start playing around with that code, testing all the stuff on the target site. But using combination of server side code and client scripts they can be fast defended.
So finally the success of a cloaked campaign depends also on how well the cloaker is built and set up but even so it will fail at a certain point, especially if runs on large budgets and run obvious ads and keywords.
 
Exactly. Most of the off-the-shelf cloakers are just surface-level filters. They’re fine for basic campaigns or short-term stuff, but useless when you’re up against deep fingerprinting and behavioral tracking. Google’s not just watching your headers—it’s watching how your page behaves. If your JS executes too fast, or DOM mutations look synthetic, they flag it. And yeah, all that telemetry flows in through Chrome, Analytics, Tag Manager, etc.

You’re leaking data even when you think you’re clean.

That’s why serious players build custom stacks with obfuscated JS, native browser APIs, headless detection bypasses, and controlled render environments.

Off-the-shelf won’t cut it if you’re trying to stay under the radar long-term.
 
PrimeCove said:
Exactly. Most of the off-the-shelf cloakers are just surface-level filters. They’re fine for basic campaigns or short-term stuff, but useless when you’re up against deep fingerprinting and behavioral tracking. Google’s not just watching your headers—it’s watching how your page behaves. If your JS executes too fast, or DOM mutations look synthetic, they flag it. And yeah, all that telemetry flows in through Chrome, Analytics, Tag Manager, etc.

You’re leaking data even when you think you’re clean.

That’s why serious players build custom stacks with obfuscated JS, native browser APIs, headless detection bypasses, and controlled render environments.

Off-the-shelf won’t cut it if you’re trying to stay under the radar long-term.
Click to expand...
Yeah idk how come people never looked into this, the worst part is that peopel are still using redirect that's a big red flag in the industry, if its not done right.
They keep trying different hosting diff and diff type of ad accounts ( i mean yeah till some extent this can work since some keywords are too sus to run ads on ) but for a long run these solutions are really bad. Hosting is never a problem you can just buy a new ip from the hosting provider and just swap it, its legit a new hosting for you. (unless you are leaking your hardware serial or something which i doubt).

Most of the cloakers that i have seen just use php and js (and their obsf is very poor, easily detectable) . If i wanted some basic filtering i can just use some public cloaker and buy some IP score api and it will work the same and cheaper than most of the cloakers out there)
 
myplaysoft said:
This telemetry of the proprietary browsers has concerned me for a long time. However, spying on users' behaviour is illegal and falls under GDPR penalty in Europe. In reality, owners of the browsers have limited access to users' activity. For apps, the situation is slighly different, in the sense that they can spy deeper into behaviour.
On the other hand, php and js can do a lot in order to mask things. JS can see very deep into visitors machines and accurately spot bots and unusual activity. So wisely used, some js can be part of a robust traffic tracking. The problem is that, when js calls cross domain scripts, becomes vulerable.
I have noticed that above medium bots analyze javascript and then start playing around with that code, testing all the stuff on the target site. But using combination of server side code and client scripts they can be fast defended.
So finally the success of a cloaked campaign depends also on how well the cloaker is built and set up but even so it will fail at a certain point, especially if runs on large budgets and run obvious ads and keywords.
Click to expand...
I agree but i am pretty sure companies like google and facebook are too wild, like they probably know by now which site (if they ever come across the site) is using which cloaker if they have an id for the type of cloakers out there (like i dont wanna offend no one but like jci , cloakerly, adspect etc.. ) like if i make my own custom bot with a bit of an effort I can easily detect if the site is cloaked or not.
 
G published a paper, a few years ago, about some of the methods they use to uncover cloaked sites, I guess it still can be found on the internet. It is noteworthy that behavioral analysis plays a key role and by using ML can tell a lot about a site.
It is a sure thing that g and fb know about cloaked sites, same with regular cloaking providers and my hunch is that they deliberately let certain cloaked sites be running in order to round up their budgets.
But combinations between js and server side methods are still strong, the problem is that if one decides to use javascript for cloaking, the simple fact of detection becomes a red flag.
A simple example would be fingerprinting combined with other metrics (like timezone), which will take down 95% of bots. Then all user behavior can be loaded into a datagram and build a ML filter.
The bottom line: well designed cloakers still have their chance.
 
How are custom cloakers made exactly? I have no previous coding experience, but I would like to learn
 
Elegante said:
most of these common cloakers work off basic stuff—IP score, user-agent, referrer, maybe some light JS fingerprinting. they run a quick check through PHP or JS, then redirect bad traffic to a clean page and good traffic to the offer or whatever. sounds solid… but it’s shallow af.
I mean it works but its kind of not that good .

( that's why people have custom solutions most of the time according to their needs) : )

Analytics gets shared from different services application in ur shopify wordpress chrome etc to these big service providers (google meta etc.)
But here’s the issue—these checks (in cloakers) don’t cover all the hidden behaviors, right? While they might block obvious bots based on IP or user-agent, they ignore deeper telemetry stuff that browsers send back. Google can track everything, from mouse movements to hidden browser calls, and that’s where these simple cloakers fall short.

Google and others got its own suite of telemetry and analytics systems that report on how a page is rendered, including DOM tree changes, element visibility, and user interaction patterns. php and js scripts are too predictable now.

It’s like trying to run a marathon with a broken sneaker
Click to expand...
Ok, but now tell me. What’s so obscure that you need this kind of complex cloak
 
Dunkerr said:
Ok, but now tell me. What’s so obscure that you need this kind of complex cloak
Click to expand...
You may also call it obscure if you prefer but the idea is simpler than that: if you stick to "traditional" filtering methods, without some behavioral analysis, the cloak will be spotted easier. For instance, you record mouse movements, take some browser fingerprint and then know how to use that data, allows a tight filtering even of some.VPNs, without a VPN IP database. On the other hand, as already mentioned, once you put visible (client) code the chences to be red flagged increase. So one has to decide the right strategy for his own campaigns.
 
Dunkerr said:
Ok, but now tell me. What’s so obscure that you need this kind of complex cloak
Click to expand...
Ad accounts are really expensive and it takes time to warm them up and setting them up on certain keywords, takes around a week or more (and then cpc to adjust) so you can start earning money.

Imagine in the middle of it your account gets fucked (talking about accounts that cost around 500-1000 usd ),

Money goes to waste (well that's okay) but wasting 1-2 weeks on a single ad or more is just sad (I would want my ad to run at least a month or two)
 
littyagain said:
How are custom cloakers made exactly? I have no previous coding experience, but I would like to learn
Click to expand...
a lot of things are involved. Everyone has their their own tricks and settings up their sleeves, no one really wants to reveal it because of the competition.
 
Elegante said:
a lot of things are involved. Everyone has their their own tricks and settings up their sleeves, no one really wants to reveal it because of the competition.
Click to expand...
Yes, I have noticed its very very hard to find information on this topic. I am willing to pay for coaching
 
littyagain said:
Yes, I have noticed its very very hard to find information on this topic. I am willing to pay for coaching
Click to expand...
I think if i get some time i might make my own cloaker, something better. I can't really teach you tho its a long way
 
Most cloakers just filter by IP, user-agent, basic stuff.
It works for noobs but it’s way too shallow.
Google tracks mouse moves, DOM changes, hidden API calls --> things PHP or JS can’t fake.
Standard cloakers = running a marathon with broken shoes.
 
Deleted member 752298 said:
Most cloakers just filter by IP, user-agent, basic stuff.
It works for noobs but it’s way too shallow.
Google tracks mouse moves, DOM changes, hidden API calls --> things PHP or JS can’t fake.
Standard cloakers = running a marathon with broken shoes.
Click to expand...
yeah that's true it doens't work at all

also people are using redirects for payment cloakers that's more sad, that also gets detected easily.
 
So is there any tweak to be able to bypass Google?
I have used many cloaks but it is really only ok for a short time.
 
Yes, it is. Preferably custom solutions. But keep in mind that some geos are harder than others.
 
AuthoritySuccess said:
So is there any tweak to be able to bypass Google?
I have used many cloaks but it is really only ok for a short time.
Click to expand...
there ways but need custom solution as i said, good amount of money is required
 
Yes, regular cloakers are standing no chance against robust security systems that are funded by hubdreds of millions of dollars, and will never Stand a chance.

There are some rules these cloakers Go by to recognize bots from Real humans, but ultimately its just a list of knows IPs + some ai that learnt patterns of bots but guess what, by the time cloaker recognizes some pattern, google already has millions of bots with new ones, so sooner or later one of them will get to black page and get your ad account banned, by reporting it cloaker can update the list and Add new pattern to avoid sending same/similar bot to get to more black Pages but its ultimately too late.

Only use cloakers and blackhat technique if you can make a Lot of money in short amount of time and its worth the hassle for you, otherwise stay away from it, especially if you are trying to build a brand or run it long term.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top