whackwhack.sh is live
<p><b>whack.sh is officially live.</b> Signups are open, the free tier is on, and the API is serving.</p>
<p>Other URL scanners have the same blind spot: they looks from one place. Cloakers and traffic distribution systems know the cloud ranges those scanners run from, and when a request arrives from one, they serve something harmless — a parked page, a dead redirect, a 404. The scanner records "clean" and moves on. The payload was never for it.</p>
<h2>What we do differently</h2>
<p>whack.sh loads the same link from several vantages <em>at the same moment</em> — a datacenter, a real residential line, a mobile carrier — and then diffs what came back. Divergence between vantages is the cloak slipping. You get a 0–100 cloaking score with the reasoning shown, not a black-box verdict.</p>
<p>For every vantage you get the full evidence: a HAR, a screenshot, the redirect chain hop by hop with ASN and reverse DNS, and any file that was served instead of a page. Indicators export as STIX 2.1, CSV, JSON or MISP, so it drops straight into whatever you already run.</p>
<p>The datacenter leg is <b>free</b> for the first 5 MB of every scan — no card, no trial clock. Paid vantages are metered per scan, and you can pin the datacenter leg to any of 53 countries when geography is the thing being tested.</p>
<h2>Built for the terminal</h2>
<p>Everything the web app does, the API does. One command, every egress:</p>
<pre><code>curl -s https://whack.sh/api/scan \
-H "Authorization: Bearer $WHACK_KEY" \
-d url="https://example.test/suspicious" \
-d egress="datacenter,residential,mobile"</code></pre>
<h2>Where it goes</h2>
<p>Confirmed-novel samples we capture are contributed back to VirusTotal, MalwareBazaar and OTX, so the wider community gets them too. We would rather the sample be public than be ours.</p>
<p><a href="/auth/signup">Start scanning free</a> · <a href="/how-it-works">See how it works</a> · <a href="/pricing">Pricing</a></p>