“Our cloak is unbreakable”, “We use artificial intelligence to analyze traffic”, “We analyze SSL fingerprints”, “A neural network scores every visitor”. Claims like these from cloak makers are a great way to attract new gullible clients and jack the price up by at least an order of magnitude. To see why all of this is nothing but marketing, you need to understand how cloaks work on the inside. That’s exactly what I’m going to walk you through today. I wrote this piece a long time ago, and a few things have changed since: headers, databases, a couple of tricks. The core is right where it was. So I’ve freshened it up rather than rewritten it.
How Does a Cloak Work?
A cloak analyzes incoming traffic and, based on the check, shows either the black page to a regular human who came from an ad, or the white page to bots and moderators. That’s it. Everything else is details — but the details are exactly where the difference lives between a cloak that works and a cloak that’s expensive.
How Is Incoming Traffic Analyzed?
The single most important point: a cloak must analyze only the data it can get before the visitor has seen the site. Obviously — because the decision about which page to show at all comes first. No “show it first, sort it out later”. And what’s available to us at that moment is, frankly, not much.
Headers That Carry IP Addresses
For analysis, these will do just fine:
- CF-Connecting-IP
- CF-Connecting-IPv6
- X-Forwarded-For
- X-Real-IP
- Client-IP
- Remote-Addr
The addresses in them can differ. For example, if someone is using Opera Turbo, or their ISP proxies traffic, the address needs to be caught in X-Forwarded-For, not Remote-Addr. And Cloudflare has a separate header for IPv6 — there’s more of that traffic every year, and you can’t ignore it anymore. So you need to analyze every address you’ve caught in these headers.
Right here you can catch the first trigger — wrong geo. That’s always, guaranteed, an automatic ban with the address going into the blacklist.
Next, the cloak has to check the IPs against its blacklist database. The quality of that database, and the tools used to build it, is the key difference between a good cloak and a bad one. In the first version of this article I wrote that I couldn’t go into detail on building complete blacklists: that, supposedly, was the secret of my cloak, AlterCPA One, which I don’t advertise, because a marvel like that needs no advertising. I confess. The “don’t advertise” part was a lie, and a big one: since then we’ve packaged those very blacklists into a separate product, and we sell it. It’s called AlterCPA Smart — IPv4, subnet and IPv6 lists, updated every five minutes, served by API key. You can plug it in anywhere: into your own Pro, Cloud or Lite, or even into someone else’s tracker like Keitaro. It requires a One plan no lower than “Standard”, which is $150 a month. So I still don’t tell the secret. I sell it.
A few things I can share for free. For instance, the network we all know as the Book of Faces publishes the address list of its own bots itself. There’s the well-known list from the NPPR team. There are various tricks for building lists: if a lot of off-target traffic comes in from one subnet, you can block the whole subnet at once. Recently, VPN databases showed up in the lists too: they’re off by default and get switched on with the full set of filters in the campaign settings.
And since we’re on VPNs — a fresh word of warning. After a recent update, my cloak catches proxies and VPNs a lot harder. The side effect landed on affiliates themselves: the beloved ritual of “launch the campaign, open it through a proxy, make sure the black page shows” doesn’t work anymore. The proxy now gets banned as a violator — because it is one — and the tester sees the white page instead of the black one. That’s not a cloak bug, that’s the cloak. Want to check your black page? Whitelist your own IP and look from there. Running your cloak through a random proxy and panicking isn’t a test of the cloak, it’s a test of your nerves.
The User-Agent Header
With a live human, you’ll instantly see a mobile device or a desktop. A bot, right here, signs off as a bot. If there’s no User-Agent at all — send it straight to the white page; a real person always has one, no exceptions. And, skipping ahead, the User-Agent is far from the only place where a visitor signs a confession about who they are.
The Accept-Language Header
For some reason, not every cloak uses it. This header lists the languages the browser accepts. Say the traffic is going to Russia, but Accept-Language only has English — off to the white page. A missing local language in Accept-Language is one of the main triggers.
The Ad Click ID
I didn’t cover this trigger in the first version of the article, and I should have — it’s one of the most reliable. Every ad network signs each click with its own parameter in the link: Facebook with fbclid, Google with gclid, TikTok with ttclid, plus a dozen or so more for other networks. A live human coming from an ad always arrives with one. Arrived without it — that means they went around the ad: typed the address by hand, opened a bookmark, or came from a moderator’s work tab. Everyone who shows up without a click goes to the white page. For Google, you don’t get to switch this check off at all.
Headers Where the Visitor Gives Themselves Away
Some bots and moderators don’t need detecting at all — they arrive with a name tag on. A few signatures I send to the white page without a second thought:
X-Purpose: preview— that’s Safari quietly preloading the page ahead of time, before the person has even tapped the link. Not a visit, a warm-up.X-FB-HTTP-Engine: liger— Facebook’s built-in engine: the page was requested by the social network itself, not a human.Via: translate.google.com— someone is viewing the site through Google Translate. A moderator’s favorite way to look at a lander in a language they don’t speak.- A referrer containing
adheart,tolokaoryandex-team.ru— that’s not a customer, that’s a spy service or a moderator coming straight from their work tab.
Notice: none of these checks needs a script or a second of waiting. All of it sits in the request headers before the cloak has even decided what to show.
Debunking the Marketing Tricks of Cloaks
Some cloaks claim to build blacklists by device fingerprint, which is an extremely dumb idea in itself. Passing it off as an advantage is strange, to say the least. First, to get a fingerprint you have to fire a JS request before the person has landed on either the white or the black site. Which, in effect, exposes part of the cloak’s own work. Google will happily slap you with a “Malicious software” error for that, and you can kiss the ad campaign goodbye. Second, the same moderator’s fingerprints change.
There’s a more interesting method — collecting SSL connection fingerprints. That’s an even bigger con. An SSL fingerprint always depends on two machines: the one making the request and the one being connected to. The same moderator will have one fingerprint when talking to one server, and a different one when talking to a second. And a cloak’s server addresses change constantly — otherwise the ad networks would simply block them. We even have a dedicated tool for exactly that address-swapping, by the way — PrivateFlare: a reverse proxy with a WAF that hides your real server and swaps domains in seconds without touching the backend. So catching visitors by SSL fingerprint doesn’t work. What it remembers isn’t the moderator — it’s the pair “moderator plus your server”, and you’ll swap the server tomorrow.
And my favorite: machine learning, artificial intelligence and neural networks of every stripe. In any field where this technology is applied there’s one crucial condition: the data you’ve got has to yield a working correlation. When a user comes in, we get neither screen size nor CPU core count — nothing you could analyze to find patterns. To do that kind of analytics properly, you’d need behavioral data, mouse movement at the very least, and that’s impossible before the page is shown. So a correlation with any decent hit rate can’t be built either. The only way this can work is by collecting data with scripts after the person has already landed on the site. Why you can’t go overboard with scripts — see above.
Let me tell you what “artificial intelligence” looks like at my place. The smart cloud lists in One — which clients, and sometimes my own marketing people, proudly call AI and machine learning — are embarrassingly simple. On a schedule, with a plain cron job, the system dumps the visit log and automatically bans the addresses and subnets that crossed the threshold of off-target hits over that period. That’s it. No neural network weighing a specific visitor by their fingerprint in real time: the “learning” happens on the aggregate mass of traffic, and it serves one purpose — keeping the blacklists from going stale. It works great. But when someone sells you the same thing as AI at ten times the price — remember this paragraph.
Cloud or Self-Hosted?
A cloak’s effectiveness depends heavily on the size and quality of its blacklists.
- A good cloud cloak analyzes the traffic of all its clients across every country and source, and adapts the blacklists accordingly. For scale: around 240 million clicks pass through our cloud a year; 156 million of them go to the trash and 84 million make it to the black page. Every bot caught on someone else’s campaign won’t get through to yours either — other people’s traffic works for you. With varied geos and small traffic volumes, the cloud option is the better one: it already has ready-made answers for every occasion. On the downside, there can be false positives on certain subnets that got banned because of some user’s mistakes. AlterCPA One is the fit here. The same filter, by the way, can also stand guard in front of your landing page so competitors can’t scrape it — I covered that in a separate case study on scraping protection.
- The advantages of a self-hosted cloak show at large traffic volumes. That option is ideal for an arbitrage team, especially one working with its own advertisers in a narrow geo. At first, this cloak may perform slightly worse while it self-trains, but a few days in it delivers a better result — one not polluted by the random sloppy campaigns of the cloud version’s users. AlterCPA Pro is the recommendation here. And if you can’t stand waiting those few days, a self-hosted cloak can be subscribed to those same Smart lists from the cloud, and you get both options at once.
What Separates a Good Cloak from a Bad One?
An expensive one from a cheap one? Every tool that actually works is primitive: analyzing IPs, User-Agents, language, whether there’s a click. A good cloak simply knows how to work with all that properly. And there are plenty of those. Expensive cloaks promise artificial intelligence and other delights, but paying for it makes no sense — unless you like the accompanying service and you’re a fan of the brand. Is my AlterCPA One better than its sane competitors? No. Can a moderator slip through it? Yes, like through every other one. It happens extremely rarely, and only a scammer will guarantee it never does. But it’s cheaper, and it works exactly the same.
Bottom Line
Don’t fall for the marketing tricks. Traffic analysis doesn’t need to be complicated — it’s primitive, if only because the cloak doesn’t have that much data to check: an address, a couple of headers, and whether there was a click. Pick a simple, solid, inexpensive option — cloud or self-hosted, to match your volume and geo — and that’s all it takes to keep slip-throughs to a minimum. Zero isn’t on the menu, no matter what. And when you see the words “neural network” in a cloak’s price list, read them as “markup”.