whackwhack.sh is live
whack.sh is officially live. Signups are open, the free tier is on, and the API is serving.
Other URL scanners have the same blind spot: they looks from one place. Cloakers and traffic distribution systems know the cloud ranges those scanners run from, and when a request arrives from one, they serve something harmless — a parked page, a dead redirect, a 404. The scanner records "clean" and moves on. The payload was never for it.
What we do differently
whack.sh loads the same link from several vantages at the same moment — a datacenter, a real residential line, a mobile carrier — and then diffs what came back. Divergence between vantages is the cloak slipping. You get a 0–100 cloaking score with the reasoning shown, not a black-box verdict.
For every vantage you get the full evidence: a HAR, a screenshot, the redirect chain hop by hop with ASN and reverse DNS, and any file that was served instead of a page. Indicators export as STIX 2.1, CSV, JSON or MISP, so it drops straight into whatever you already run.
The datacenter leg is free for the first 5 MB of every scan — no card, no trial clock. Paid vantages are metered per scan, and you can pin the datacenter leg to any of 53 countries when geography is the thing being tested.
Built for the terminal
Everything the web app does, the API does. One command, every egress:
curl -s https://whack.sh/api/scan \
-H "Authorization: Bearer $WHACK_KEY" \
-d url="https://example.test/suspicious" \
-d egress="datacenter,residential,mobile"Where it goes
Confirmed-novel samples we capture are contributed back to VirusTotal, MalwareBazaar and OTX, so the wider community gets them too. We would rather the sample be public than be ours.