Frequently asked questions

Those tools scan a URL from one vantage point — typically a datacenter IP. Cloakers know datacenter ranges cold and serve them a clean decoy, so the threat never shows up. whack.sh loads the same URL through datacenter, residential and mobile egress simultaneously and diffs the results — built to catch the page that only misbehaves when it thinks no analyst is watching.

It’s the core of the product. We capture the full HAR, screenshot timeline and redirect chain from each egress type, then diff them against each other. When the datacenter capture shows a parked page but the mobile capture drops a fake login or a forced download, that divergence is the cloak — caught in the act.

Yes — it’s a core reason multi-egress matters. Beyond datacenter-vs-real-user, advanced kits fingerprint the visitor’s ASN and serve org-specific payloads — a fake corporate login to a bank’s range, for instance — to harvest employee or VPN credentials. whack.sh exposes the payload served to the vantage points that matter and logs which payload hits which ASN, so you can map exactly who a campaign is targeting.

We measure divergence across your egress captures — differences in DOM, redirect chains, network requests and rendered screenshots — and roll it into a single 0–100 score. Zero means the page looked identical no matter who asked; a high score means it served materially different content to different IP types.

Egress is the kind of IP your scan exits from: datacenter (cloud ranges), residential (real home ISP IPs) or mobile (real carrier IPs). Cloakers trust residential and mobile far more than datacenter. Mobile costs more because carrier IPs are the scarcest and most expensive to source — the multiplier reflects that reality.

No — and that’s deliberate. Every egress does a full, faithful load in real Chromium, with JavaScript executed and every resource fetched, exactly like a real visitor. Cutting corners to save bytes — blocking images, skipping JS, HEAD-only requests, bailing out early — is precisely the behavioral fingerprint cloakers watch for, so it would defeat the whole point. We stay lean by trimming response bodies from the stored HAR (never from the load); a served payload the browser downloads is kept as evidence — no separate re-fetch — bounded by your byte cap. The trade-off: paid residential/mobile egress meters the real bytes of that faithful load — to control spend, scan datacenter-first (free for the first 5 MB) and escalate to paid egress only when you want the cross-IP diff.

Datacenter egress is free for the first 5 MB of every scan (then 1 cr/MB) — including the full curl-first API. Sign up for a free key and scan with datacenter egress, web or curl, no card. Residential and mobile egress are the paid tier, and the Split-Horizon Diff is the premium unlock that exposes cloaking a datacenter-only scan can’t see.

Paid egress is metered: a base credit per leg includes the first 5 MB, then a small per-MB overage — residential = 5 cr + 1 cr/MB, mobile = 10 cr + 2 cr/MB, datacenter = free for the first 5 MB, then 1 cr/MB. The cap you choose is the most a scan can ever cost. You set daily and monthly caps per account, and velocity anomaly detection auto-pauses a key on a spike. No — an offline or unreachable URL is never charged: if a leg gets essentially nothing back, you pay nothing for that leg.

whack.sh scans public URLs — the same content any visitor to that link would receive. Sensitive targets (.gov, .mil, financial institutions) are handled carefully with extra guardrails. It’s a defensive tool for investigators: expose threats, don’t attack infrastructure, and stay inside the AUP you agree to at signup.

Every endpoint is a curl endpoint — anything in the web UI works from a shell with whack <url>. The API key is your login: paste it or click a one-time magic link for an httpOnly session, no passwords to manage or leak. Automate scans and pull results as JSON straight from the terminal.

When a target serves a forced download, the scanner keeps the very file it delivered to your browser — there’s no separate fetch of the payload URL, which is the classic tell that lets a distributor cloak your ASN on the next hit. The captured file is neutralized at rest — defanged so it can’t execute or trip AV — then hashed against multiple public malware databases; you get its sha256, a VirusTotal link, and IOC export to CSV, STIX 2.1 or MISP. The raw sample is never web-distributed from whack.sh, and confirmed-malicious samples are contributed to the public malware-research community (VirusTotal, abuse.ch MalwareBazaar, AlienVault OTX) so other defenders can block them — real evidence, put to work, without handing live malware to the general public. Neither your identity nor the scanned URL is published with a sample; benign or unconfirmed captures are never contributed. Capture is bounded by the byte cap you set (up to 100 MB), and it’s best-effort: on a fast-rotating host we may prove the payload deployed yet not land the sample before it disappears.

Yes. Free datacenter scanning runs under standard rate limits, and paid egress is governed by the per-account daily and monthly credit caps you set. Velocity anomaly detection watches for spikes — if a key burns credits abnormally fast, it auto-pauses and alerts the operator, so a misfiring script or stolen key can’t quietly empty your account. And a hostile page can’t pad itself to drain you: oversized or junk-bloated responses are handled the way a real browser does — streamed, not bulk-downloaded — bounded, and flagged as evasive rather than billed blindly.

Yes. The datacenter leg can exit in any of 53 countries you choose, routed in-country at the same price as a US datacenter scan (free for the first 5 MB, then 1 cr/MB). A paid residential or mobile leg can also exit a non-US country for a flat +2 credits. The report shows the true exit country, verified when the exit is probed. Coverage is best-effort — you choose the country, not a guaranteed city or carrier.

Optionally — you can add a plain-English AI summary to a scan for a flat 3 credits, charged only if it actually runs. It turns the scan’s own automated signals and verdict into readable prose so a non-analyst gets an at-a-glance read; it’s off unless you ask for it.

Create an account and your free key is issued immediately — no card. That covers datacenter egress (free for the first 5 MB of every scan) and the full curl-first API. Top up credits when you need residential or mobile egress to expose a cloak, or subscribe to a plan for monthly credits and perks. Credits never expire.