whackReferer-gated cloaking: why our scanner arrives with a source
A page can serve one thing to a visitor who arrived from an ad and something else to a visitor who arrived from nowhere. Traffic source picks the branch.
A scanner that opens the link cold states no source. It lands in the branch built for everyone the campaign did not pay for.
Cloaked delivery itself is settled ground, and our writeup on a cloaked link that showed scanners a clean page covers the foundation. That post listed a referer gate among the limits of comparing vantage points.
Our scanner can request a URL with a specified referring source and carry it through the redirect chain.
Why a cold scan lands on the clean page
A browser normally tells a site which page sent the visitor. The Referer field is an ordinary part of a web request. Whatever client makes the request supplies the value itself, and nothing authenticates it.
A source-gated page reads that self-reported value and branches on it. A visitor whose stated source matches the campaign reaches the payload. Everyone else reaches a clean page.
No page sent the automated request, so the field arrives empty. To the page's rule, an empty source is the wrong source, so the clean page is the correct output of the operator's own logic.
The verdict is accurate about that one fetch. It says nothing about what the URL serves the intended audience.
The gate works by requirement instead of detection
Fingerprinting a scanner is work. The operator has to model automation tells, and that model needs maintenance as clients change.
A source gate skips all of it. The operator requires something a checker has no reason to send, and every client that fails to send it sorts itself into the harmless branch.
The page never has to recognize a scanner to defeat one. A better client profile or a cleaner egress changes nothing about the value the page is keyed on.
Cold checkers agree with each other by design
Most public checkers fetch cold, and a cold fetch states no source. Pointed at a source-gated page, they receive the clean branch.
Their results then agree. Agreement across tools reads like confirmation while it repeats one observation several times.
That shared habit correlates the answers, so agreement can grow while the evidence behind it does not.
Source gating is delivery discipline
Campaigns buy specific traffic. An operator who pays for clicks from one channel wants the payload spent on that channel's visitors, and serving anyone else is cost with no return.
Every copy handed out is also a copy that can be collected, submitted and written into a signature. The clean branch costs nothing to give away, so the operator hands it to everyone outside the audience it paid for.
The rule lives in the campaign rather than in any one host, so replacing a domain does not require rewriting it.
Reading these gates as budget control explains behavior that looks strange otherwise. A page can ignore your client fingerprint and still serve you nothing, because it is checking where you say you came from.
What survives the redirect chain
A link rarely answers on the first hop. Clicks pass through tracking links, shorteners and intermediate pages before the destination replies.
What the destination sees depends on what survived those hops. A stated source can be carried forward, rewritten or dropped along the way, and the hop that decides what to serve is the last one.
Two checkers can disagree about the same link without either one malfunctioning. One held the context across the chain and the other lost it, so they asked the destination different questions.
Our scanner can specify a source and hold it through those hops. Where that source is the one the gate is keyed on, the destination answers the way it answers the intended visitor.
An analyst sets the source inside the engine, and choosing which source to try is a judgment call.
The verdict comes from the captured artifact
We fetch the URL from datacenter, residential and mobile networks and keep the real response body. Classification reads what that artifact is and what it does.
Counting how many engines have voted on a domain answers a different question. One domain that reputation engines rated clean served a large obfuscated payload when we fetched it, and the capture is what showed it.
Keeping the body is what makes comparison possible. The same URL fetched two ways produces two artifacts, and the pair is the finding.
Client-type cloaking inverts the usual assumption
Client-type cloaking is an evasion class we see and track, and reading it out of a capture is analyst work today.
The familiar cloak feeds real browsers the payload and automated clients a harmless page. Some hosts run it the other way around.
The file goes to an automated application client. An ordinary web browser receives a firewall block page, and a browser-based check reads that block as a dead end.
The block page is part of the delivery. It answers the observer most likely to be a checker, and it answers with something that reads as safety.
Where source control stops
Source control does not tell you which source to try. A gate keyed to a value nobody guessed returns the clean page, and the space of plausible sources is large.
Any client can state any source, which is what makes the gate cheap to build and cheap to stack. An operator who adds a second condition on top of the source check reopens the gap. The gain is that conditional delivery costs the operator more to hide.
Gates a fetch cannot open
Some branches demand what no fetch can produce:
- A valid session established by a real login.
- A one-time click token that has already been spent.
- An authenticated context tied to a specific account.
Source control does not touch that class. A payload served once per address also defeats the confirming second look, which our earlier post covers alongside the limits around session cookies and the time of day.
Divergence starts a human read
Branching on traffic source is common outside abuse. Hotlink protection, anti-scraping rules, paywalls and partner licensing all decide on the same signal, so a split tells you the page branches and stays quiet about why.
That limit was published with the first post on this subject and it holds unchanged on the source axis. A clean result tells you which sources we tried and when. The sources we did not try stay open.
One line of that published list changes. A checker can now arrive with a source stated, and the rest of the list stands as written.
Checking a link against a source gate
Against a source-gated page, a single cold fetch returns the branch the operator built for checkers. Two fetches of one URL that differ only in the source stated is the cheapest test that gate fails.
A link that answers those two fetches two different ways has told you something a verdict cannot. A multi-egress scan at whack.sh records each fetch and the body it returned.