Ad-Cloaking Glossary

Plain-language definitions for the ad-cloaking, traffic-filtering, and ad-review terms you'll run into configuring a Cloaking X stream — grouped by what each term actually describes, not alphabetically.

Core Concepts

Safe Page / White Page: In ad cloaking, the safe page (also called the white page) is the compliant, policy-clean content shown to an ad platform's review crawler, bots, and any visitor a filter decides not to trust — while real prospective buyers are routed to the money page instead. Cloaking X calls this a stream's Fallback Page: it's a real HTTP 200 response, not an error, so a reviewer sees a normal, on-topic page rather than anything resembling a block.
Money Page / Black Page: The money page (sometimes called the black page) is the actual offer — the landing page a real, qualified visitor is meant to see and convert on, kept hidden from an ad platform's reviewer and other untrusted traffic. In Cloaking X this is a stream's configured destination URL, delivered through one of 8 delivery modes (proxy, mirror, redirect302, iframe, and others) only to visitors that pass the stream's filtering checks.
Grey Page: A grey page is a middle-ground landing page — less obviously compliant than a true white/safe page but not the full, unrestricted offer either — sometimes used in the industry when an advertiser wants a single page to survive manual review without a strict safe/money split. Cloaking X's own stream model doesn't have a distinct grey-page tier: every visitor is placed into exactly one of two buckets, the fallback (safe) page or the money page, never a blended third option.
TDS (Traffic Distribution System): A TDS (traffic distribution system) is software that receives an ad click and decides, based on rules like geo, device, or traffic source, which of several possible destinations to send that specific visitor to. A Cloaking X stream performs a narrower, two-way version of this decision — safe page vs. money page, based on bot/reviewer/fraud detection — rather than routing across many arbitrary destinations the way a general-purpose TDS (RedTrack, Voluum, Keitaro, Binom) does; those tools are commonly chained in front of, or alongside, a stream.
Stream: A stream is Cloaking X's core configuration unit: one tracking link or filter installation tied to one money page (or set of destinations), one fallback page, its own detection thresholds, allow-lists, and delivery mode. Every visitor's click is evaluated against the specific stream it arrived through, and each stream's settings apply only to that stream's own traffic — a threshold change on one stream never affects another.
Filter: The filter is the piece of code — a JS snippet, PHP script, WordPress plugin, or a native Keitaro/Binom integration — installed on or in front of a landing page that actually runs a stream's check on each visitor and enforces its routing decision. Cloaking X ships several filter delivery methods for different site stacks, but every one of them calls back to the same underlying check pipeline.
Cloaking (Ad Cloaking): Ad cloaking is showing an ad platform's own review crawler different content than what a real visitor sees at the same URL — used to keep a policy-sensitive but legitimate offer (certain betting, adult, pharma, or aggressive-marketing verticals) compliant with a platform's landing-page review while still delivering the intended offer to genuine buyers. It's a distinct concept from link cloaking (masking an affiliate URL) and SEO cloaking (showing search engines different content than visitors) — see the disambiguation page for the full breakdown.
Whitelist: A whitelist is a list of IP addresses, ranges, or other identifiers that always bypass a stream's detection checks entirely and go straight to the money page — used for an operator's own testing IPs, trusted traffic sources, or known-good partners. The one override that ignores even a whitelist entry is Review mode, which intentionally forces the fallback page for 100% of traffic during an ad platform's own review window.
Blacklist: A blacklist is a list of IP addresses, networks, or User-Agents that are always routed to the fallback page regardless of how clean the rest of the visit looks — either entries an operator adds manually, or matches against Cloaking X's own shared system blacklist of known bad actors. It's a hard override, evaluated before the automated risk-scoring checks run.
Fallback Page: The fallback page is Cloaking X's product name for a stream's configured safe/white page — the destination shown to any visitor a stream decides not to trust (reviewers, bots, blocked traffic) or during Review mode. It's always delivered as a direct, real HTTP 200 render, never through any of the delivery modes used for the money page, and never as an error response.
Geo Filtering: Geo filtering restricts a stream to only deliver the money page to visitors whose IP-resolved country (and optionally OS or device type) matches an explicit allow-list — anyone outside it is routed to the fallback page automatically, as a hard override independent of how clean the rest of the visit otherwise looks. It's commonly set to match a campaign's actual ad targeting, so a visitor from a country the ad was never shown in doesn't reach the offer.

Delivery

Mirror Delivery: Mirror is a Cloaking X delivery mode that fetches the money page's HTML server-side and rewrites every asset reference so it routes back through the operator's own tracking domain — the destination's real hostname never appears anywhere in the page source, not even in a <base href> tag. It's the delivery mode built specifically for keeping the money page's hostname out of plaintext entirely, at the cost of occasionally needing a compatibility shim for complex JavaScript-heavy destinations.
Proxy Delivery: Proxy is Cloaking X's default delivery mode — the server fetches the destination's HTML and serves it directly under the operator's own address bar, with no redirect at all. The trade-off is that the destination's own asset URLs and <base href> still resolve in plaintext against the real money-page hostname, visible to anyone who views page source.
Redirect (302) Delivery: redirect302 is a Cloaking X delivery mode that sends a temporary, never-cached HTTP 302 redirect to the money page, using history-replace so the browser's Back button can't create a loop. A same-domain 302 (staying on the operator's own tracking domain) reads as ordinary navigation, while a cross-domain, top-level 302 straight to an unrelated money-page domain is one of the most well-documented cloaking signatures ad platforms' compliance scanners are built to catch.
Iframe Delivery: Iframe is a Cloaking X delivery mode that renders the money page inside a full-viewport iframe rather than navigating to it — the address bar never changes, and it's the only delivery mode that keeps domain-locked video embeds (VTurb, ConverteAI) working, since those players refuse to run once served from an unfamiliar hostname. The trade-off is that the injected iframe and its real network hop are still visible to anyone who inspects the page in DevTools.
Click-Reveal: Click-reveal is a Cloaking X delivery mode where the visible page shows only a Continue button, and the destination isn't referenced anywhere in the response at all until a genuine click event fires — the strongest shape against any fully-automated scanner that doesn't simulate a real user interaction. The trade-off is one extra interaction step for real visitors before they reach the offer.

Detection

JS Fingerprint: A JS (JavaScript) fingerprint is a set of browser-environment signals a page's own script collects client-side — canvas/WebGL output, installed fonts, screen and hardware characteristics, automation-framework artifacts, and interaction timing — combined into a signal used to tell a genuine human browsing session apart from a bot, headless browser, or scripted replay. Cloaking X's own snippet collects this payload and cross-checks it for internal consistency (for example, a claimed User-Agent that doesn't match the browser's reported capabilities) as one input into a visit's overall risk score.
JA3 / JA4 Fingerprint: JA3, and its successor JA4, are TLS fingerprinting methods that summarize the exact ordering and values of a client's TLS ClientHello — cipher list, extensions, ALPN — into a short digest, without requiring any client-side JavaScript at all, since it comes from the raw TLS handshake itself. A genuine, unmodified, current install of Chrome, Firefox, Safari, or Edge always negotiates TLS in a small number of predictable, well-known shapes; a JA4 digest that doesn't match any of them is a cross-check signal against the claimed User-Agent that the connection isn't coming from a real, unmodified browser.
Headless Browser: A headless browser is a real browser engine — Chromium, Firefox, or WebKit — running without a visible window or display, used legitimately for automated testing and web scraping, and by bots designed to pass basic JavaScript-execution checks a simple HTTP-only scraper would fail. It leaves technical traces a normal, user-driven browser session doesn't (missing screen/display properties, automation-framework artifacts, contradictory capability checks), which fingerprint-based detection is built to catch.
Reviewer Bot / Ad-Review Crawler: A reviewer bot (or ad-review crawler) is an ad platform's own automated system that fetches a campaign's landing page to check it against advertising policy before, and sometimes well after, approval — Google's AdsBot and Googlebot, Meta's facebookexternalhit, TikTok's review infrastructure, and equivalents at Microsoft/Bing and other platforms. Cloaking X attributes each platform's reviewer by its published IP ranges and network origin (ASN) and routes it to the stream's fallback page, while a real click reaches the money page.
Delayed Re-Crawl: A delayed re-crawl is a second, later automated check an ad platform performs on a landing page — sometimes days after the campaign's initial approval — rather than reviewing only once at submission time. Cloaking X detects this pattern by recognizing when the same device fingerprint returns to the exact same stream after an unusual delay, and treats that repeat visit as a likely re-crawl rather than a genuine returning buyer.
False Positive: A false positive is a genuine, legitimate visitor — a real buyer, or the operator's own testing — incorrectly blocked and shown the fallback page instead of the money page. Common causes include testing directly from a bookmarked or pasted URL with no click ID on a stream that requires one, testing while a stream is in Review mode (which shows the fallback page to 100% of traffic by design, including whitelisted IPs), or an overly aggressive block threshold catching real visitors on shared/CGNAT networks alongside actual bots.
Referrer Spoofing: Referrer spoofing is sending a fabricated or stripped Referrer/Referer header to make traffic look like it originated from a different source than it actually did — used both defensively (a legitimate delivery technique to avoid leaking the money page's origin to any site it links out to) and as a fraud/evasion technique (disguising bot or click-farm traffic as coming from a real ad platform). Cloaking X's own money-redirect responses set Referrer-Policy: no-referrer so the money page never even receives a referrer header that could leak the operator's tracking domain.
Antidetect Browser: An antidetect browser is a specialized browser, or a modified real one, built to run many separate, internally-consistent browser fingerprints — spoofed canvas/WebGL output, fonts, screen size, timezone, and other properties — from a single machine, so each session looks like a different, genuine visitor rather than the same automation tool running repeatedly. It's the tool of choice for anyone deliberately trying to defeat browser-fingerprint-based fraud and reviewer detection, which is why detection layers that cross-check several signals against each other for internal contradictions are stronger than ones that trust any single signal in isolation.
IVT (Invalid Traffic): IVT (Invalid Traffic) is the ad-industry umbrella term, defined by the Media Rating Council, for any click or impression that shouldn't be counted or paid for — bots, scrapers, click farms, and other non-human or fraudulent activity. General Invalid Traffic (GIVT) covers traffic identifiable by known lists and patterns, such as declared bots and known crawlers; Sophisticated Invalid Traffic (SIVT) requires more advanced detection — behavioral analysis, fingerprint cross-checks — to catch. Cloaking X's fraud and bot-detection layers exist to filter both categories out of a stream's real traffic and reporting.
Checker Bot: A checker bot is an automated crawler run by a third-party ad-compliance monitoring service — BrandVerity, GeoEdge, AdSecure, and similar — used by advertisers, agencies, or ad platforms themselves to scan live ad landing pages at scale for policy violations, including cloaking. It's distinct from an ad platform's own reviewer bot (AdsBot, Googlebot, facebookexternalhit): checker-bot traffic often arrives from IP ranges and User-Agents that aren't as clearly published or documented as a platform's own crawler, making it a harder category to attribute with certainty than the platform reviewers.
Safe Browsing: Google Safe Browsing is Google's own domain-reputation system, independent of ad review, that flags a domain as compromised or as serving malicious or unwanted software — the verdict applies domain-wide, not to a single URL, and can trigger from something as unrelated to ad cloaking as a compromised WordPress plugin or an injected third-party ad script on the destination. A Safe Browsing flag isn't something a traffic filter can fix or cause, since the filter only inspects and routes incoming requests — it never adds a script or download to a page a passed visitor receives.
Bot Score: A bot score — Cloaking X calls this a risk score, on a 0.00-1.00 scale — is a single numeric summary of how likely a given visit is to be a bot, reviewer, or fraudulent click, computed by combining every individual detection signal (IP intelligence, fingerprint checks, header integrity, click-ID history) into one weighted value. A stream's configurable block threshold decides how high that score has to climb before a visit is sent to the fallback page instead of the money page; raising the threshold blocks more aggressively, lowering it lets more borderline traffic through.

Traffic

Residential Proxy: A residential proxy routes traffic through a real home or mobile ISP's IP address — one that belongs to an actual subscriber's internet connection — rather than a datacenter, which makes it look identical to genuine consumer traffic from IP intelligence alone. Cloaking X detects residential-proxy exits as their own signal, but as of 2026-08-16 that signal alone can never send a visit to the fallback page — it only adds weight alongside at least one other independent check, since real subscribers on shared/CGNAT networks can otherwise get caught by mistake.
Datacenter Proxy: A datacenter proxy routes traffic through an IP address registered to a hosting or cloud provider rather than a residential or mobile ISP. Real ad-platform buyers essentially never browse from a datacenter IP, so Cloaking X treats a detected datacenter IP as a strong, largely unambiguous bot or scraper signal on its own.
Mobile Proxy: A mobile proxy routes traffic through an IP address on an actual cellular carrier network, which typically sits behind carrier-grade NAT (CGNAT) shared by thousands of real subscribers — making mobile-proxy traffic the hardest proxy category to distinguish from genuine mobile visitors using IP data alone. This is why Cloaking X's detection layers cross-check IP intelligence against device-level signals, such as motion-sensor behavior and browser capability fingerprints, rather than relying on IP classification by itself for mobile traffic.
ASN: An ASN (Autonomous System Number) identifies the specific network operator that owns and routes a block of IP addresses — every IP on the internet belongs to exactly one ASN. Ad platforms' own review crawlers originate from their own published ASN — Google's AdsBot and Googlebot, for example, both run on AS15169 — and Cloaking X attributes reviewer traffic partly by matching a request's IP against these known ASNs, separately flagging IPs on known hosting/bot-infrastructure ASNs as a datacenter signal.
Click-ID: A click ID is a unique identifier an ad platform appends to a landing-page URL when a real ad click occurs — gclid (Google, standard web click), gbraid (Google, iOS app-to-web), wbraid (Google, web-to-app), fbclid (Meta), ttclid (TikTok), msclkid (Microsoft/Bing), and equivalents on Yandex, X/Twitter, Snapchat, Pinterest, LinkedIn, and Taboola. A stream can require a recognized click ID on every request — Require Click ID — so that direct link visits, bookmarks, and bot traffic with no click ID attached never reach the money page at all.
Click-ID Reuse: Click-ID reuse is a fraud pattern where the same click-ID value shows up on more requests, or from more distinct locations, than one real person's own click could plausibly generate — for example, the same gclid appearing from two countries within a time window too short to travel between them ("impossible travel"), or from far more distinct IPs than one person's own devices would explain ("high-volume" reuse). Cloaking X checks for this per platform (Google, Meta, TikTok, Microsoft/Bing, Yandex, X, Snapchat, Pinterest, LinkedIn, Taboola) since it signals the traffic source itself, not any one visitor's browser, is compromised.

Integrations

Reverse Integration: Reverse integration is when a link the cloaking service itself issues and hosts — Cloaking X's Hosted Ad Link — is placed directly into the ad platform as the campaign's Final URL. The visitor is routed to that link first, the check runs there, and only a passing visitor is delivered onward, with no code ever installed on the destination site — the option for affiliates who don't have server access to the offer they're promoting.
Forward Integration: Forward integration is the opposite pattern from reverse integration — a JS snippet, PHP filter, or WordPress plugin is installed directly on the operator's own landing page, and the check runs inline as that page loads, before it reveals itself. The ad's Final URL points straight at the real landing page, not at a separately hosted link, which requires having code-level access to the destination.