Pipeline Architecture

How Cloakly Pro Operates

Two-phase detection pipeline: ultra-fast server-side verification followed by hardware-level encrypted browser challenges for ambiguous traffic.

Phase 1 — Server Entry

Inbound Click Received

PHP extracts IP, HTTP headers, Sec-Ch-Ua client hints, and conducts low-latency local GeoIP lookups.

Remote IPHTTP HeadersUser-AgentGeoLite2 MMDB

Phase 1 — Server Inspection

Five Independent Verification Checks

System checks ASN ranges, proxy headers, bogon IPs, and known crawlers. Flagged automated bots are immediately filtered.

IpCidrCheckUserAgentCheckVpnProxyCheckHeaderFPCheckGeoIpCheck

Phase 2 — Browser Fingerprint

Encrypted Client-Side Challenge

Ambiguous visitors receive an invisible micro-challenge. The lightweight script samples 7 deep client hardware signals.

Canvas 2DWebGL GPUAudioContextSystem FontsPuppeteer FlagsTimezone Offset

Phase 2 — Cryptography

AES-256-GCM Payload Dispatch

Hardware telemetry is authenticated via the Web Crypto API. Single-use IP-bound nonces eliminate replay attacks.

AES-256-GCMIP-Bound Nonce300s TTLZero Replay

Routing Decision

Final Score & Zero-Redirect Forwarding

Combined score (0-100) is evaluated against campaign risk thresholds. Real buyers see the Money Page without footprint.

allow → Money Pagesafe_page → White Pageblock_403block_404

Risk Score Zones

Thresholds fully customizable per campaign in your dashboard

Risk Range & Routing Action Configurable 0-100

0–39

Allowed → Money Page (Black Page)

40–79

Suspicious → JS Micro-Challenge

80–100

Blocked Bot → Safe Page / Decoy

Experience zero-redirect protection built for modern ad networks.