SOC 2 Type II · ISO/IEC 27001 · GDPR

The filtering layer that runs in front of your traffic router

Roughly one click in six that reaches a funnel is a scraper fleet, a compliance sweep or a rented residential proxy. CloakShield Pro scores each one at the edge in 7.2 ms and passes only the real ones through to Cloaking House, Keitaro, Voluum or whatever you route with today.

Create an account View pricing
Live behind one CNAME in about 15 minutes Fails open — a timeout never costs a click Operating since 2019 · 38 edge PoPs
Filtering in front of media buying teams at NorthbeamMedia VerrillGrowth KestrelPerf ArdentAcquisition HaldenDigital SableRoute
SOC 2 Type II ISO/IEC 27001 GDPR & CCPA 7.2 ms p95 verdict 38 edge PoPs 99.982% uptime
Platform

A filtering layer in front of the router you already run

CloakShield scores the request, resolves the real geography and checks the landing page is still the page you published — then hands the visitor to your existing flow untouched.

Bot filtering

Four independent signals score every click — ASN reputation, TLS fingerprint, headless indicators and request cadence. A verdict lands in 7.2 ms at p95.

Geo resolution

Country, region and carrier resolved from GeoIP2 and an ASN lookup, then cross-checked against language and timezone. A mismatch is marked proxied, not trusted.

Page integrity

Every landing page is fetched from 30 vantage points each minute and diffed against what you published. Injected scripts and dead offer links raise an alert with the diff.

Funnel masking

Response-level masking rotates class names and DOM structure per session, so competitive-intelligence crawlers and spy tools cannot fingerprint your templates.

Platform agnostic

Click parameters — sub1–sub10, clickid, cost — are forwarded verbatim and postbacks replayed in the format your platform already accepts.

One record to switch on

One CNAME and an API key, or a single script tag if you would rather not touch DNS. Rolling back is deleting the record — we hold no campaign state of our own.

How each signal is computed
ASN & datacenter reputation41,300 published ranges, refreshed daily
TLS fingerprintJA4 hash checked against the declared User-Agent
Headless indicatorsnavigator.webdriver, WebGL vendor, canvas hash
Request cadenceRolling rate per /24, tuned per campaign
Verdict latency7.2 ms p95 · 2.4 ms median · fails open
Integrity checks30 vantage points, DOM hash with dynamic nodes excluded
How it works

From DNS record to filtered traffic in four steps

Point

Add one CNAME for your campaign domain. Your router keeps its address and its rules — nothing is migrated.

Score

Every click is scored at the nearest edge PoP. A verdict lands in 7.2 ms at p95, and a timeout passes the visitor through.

Hand off

Clean traffic reaches your platform with parameters untouched and the verdict attached, so existing flows decide as they do now.

Watch

Landing pages are diffed every minute against the version you published, and tampering raises an alert with the diff attached.

Inside the product

The console you get after the CNAME resolves

Every scored click with the signal that decided it, the integrity state of each landing page, and the latency you are paying for it.

Sample workspace, populated with representative traffic. Open the full walkthrough.

Compatibility

Runs in front of your cloaker, not in place of it

Cloaking House, Keitaro, Voluum and the rest keep every campaign, flow, stream and offer where it is today. There is no migration step to plan.

Cloaking House Keitaro Voluum Binom RedTrack
CNAME · pre-filter

Point the campaign domain at a CloakShield edge PoP and leave Cloaking House as the decision layer behind it. The verdict travels as request headers — x-cs-score, x-cs-asn, x-cs-geo — alongside the untouched query string, so your white-page and offer rules read an enriched request instead of a bare IP.

  • Verdict headers on every forwarded request
  • White-page and offer rules stay as written
  • One DNS record to add, the same one to remove

What CloakShield takes on

  • Scoring the request before it reaches your router
  • Geo, ASN and carrier resolution, cross-checked against headers
  • Landing page integrity checks from 30 vantage points
  • Response-level masking against competitive crawlers

What stays in your platform

  • Campaigns, flows, streams and routing rules
  • Offer data, affiliate network links and caps
  • Split-test weights and the numbers behind them
  • Reporting of record, postbacks and payouts
Trackers, cloakers and 214 connectors we also run alongside

Traffic routing platforms

BeMobTracker
AdsBridgeTracker
PeerClickTracker
ThriveTrackerTracker
FunnelFluxTracker
AdspectCloaking
ZeustrakCloaking
TrafficArmorCloaking
In-house routersCustom

Traffic sources, infrastructure and alerting

Google AdsCost · conversions
Meta AdsCost · conversions
TikTok AdsCost · conversions
Microsoft AdsCost · conversions
TaboolaNative
OutbrainNative
CloudflareDNS & CDN
MaxMind GeoIP2Geo & ASN data
Slack & TelegramAlerts
S3 & BigQueryLog export
GrafanaDashboards
REST & webhooksEverything else

CloakShield holds no campaign state of its own. Nothing is exported into it, so removing it is deleting one DNS record — your platform is still the system of record the next morning.

Pricing

Straightforward plans, no per-seat surprises

Every plan includes bot filtering, geo resolution and landing page monitoring. What changes is volume, how many domains you run, and how fast someone answers you.

Starter
$150 / month

Billed monthly · cancel anytime

For one buyer running a handful of campaigns on a single domain.

  • Bot filtering, 1 campaign domain
  • 5,000 filtered clicks / month
  • 1 platform integration
  • Geo & ASN resolution
  • Standard support, 24–48 h
Create account
Professional Most chosen
$350 / month

Billed monthly · cancel anytime

For media buyers running several offers across more than one traffic source.

  • Everything in Starter
  • 25,000 filtered clicks / month
  • 3+ platform integrations
  • Landing page integrity monitoring
  • Funnel masking against scrapers
  • Priority support, 8 h response
Create account
Enterprise
$500 / month

Billed monthly · cancel anytime

For teams buying at volume who need custom rules and a named engineer.

  • Everything in Professional
  • 100,000 filtered clicks / month
  • Unlimited domains & integrations
  • Full API access & custom filter rules
  • White-label reporting
  • 24/7 support with a named engineer
Create account

Plans are activated from inside the workspace. Create an account, confirm your email address, and the plan you picked here is waiting on the billing screen — payment is in BTC, ETH, SOL or USDT.

Work out a 2–12 month term

Prepay and pay less

Two or three months takes 10% off the list price. Six months takes 15%. Twelve months is our annual rate at 20% off — $1,440, $3,360 or $4,800 depending on plan.

Plan
Term
$350.00 × 1 month$350.00
Due at activation$350.00
Create account

Effective $350.00 per month

Customers

What changed after the first quarter

About a fifth of what one push source billed us had no browser behind it at all. The ASN pattern was obvious inside a week, and we cut the source before the next invoice cleared.

Priya Raghunathan
Head of Media Buying, Verrill Growth

Our host pushed an analytics script into four landers without telling anyone. We heard about it from a DOM diff at 03:40, not from a conversion dip three days later.

Tomás Béres
Head of Technology, Northwind Media

I was ready for the latency argument with our buying team. We measured 6.9 ms at p95 on the redirect path, which was quiet enough that nobody brought it up again.

Adaeze Okonkwo
Performance Director, Kestrel Acquisition
FAQ

Questions we get on the first call

Anything else, ask support — a human answers.

Do we have to move our campaigns into CloakShield?
No, and there is nowhere to move them to. CloakShield holds no campaign state — your flows, streams, offers and split weights stay in Cloaking House, Keitaro, Voluum or whatever you run. We add one hop in front of it, and removing that hop is deleting a DNS record.
What does the extra hop do to latency?
Scoring happens at the nearest of 38 edge PoPs, so the visitor is not routed across the world to reach us. The added cost is 7.2 ms at p95 and about 2.4 ms at the median. If the scorer times out the request is passed straight through rather than dropped — a bad minute on our side never costs you a click.
What decides whether a click gets filtered?
Four independent signals: ASN and datacenter reputation across 41,300 published ranges, a JA4 TLS fingerprint checked against the declared User-Agent, headless indicators such as navigator.webdriver and canvas hash collisions, and request cadence per /24. Thresholds are yours to tune, and every verdict is logged with the signal that decided it, so you can audit a call you disagree with.
Do I need an account before I can subscribe?
Yes. Registration comes first: you tell us whether you are buying as an individual, a sole proprietor or a company, confirm your email address, and land in the workspace. The plan you chose on this page is carried through, and billing is activated from inside the workspace rather than from the marketing site.
What counts as a filtered click?
One scored request through the edge, whether it ends up passed or stopped. Landing page integrity checks, dashboard views, API reads and postback replays are not metered. If you go over, nothing breaks — you are billed for the overage at the same rate rather than throttled mid-campaign.
How long does setup actually take?
One CNAME and an API key, or a single script tag if you would rather not touch DNS — about 15 minutes. Existing campaigns import over the Keitaro and Voluum REST APIs, so flows and offer IDs map across instead of being retyped. Most buyers have a first campaign running through it the same afternoon.
Can we cancel or change plans mid-term?
Monthly plans can be cancelled at any point and stay active to the end of the paid period. Upgrades take effect immediately with the remaining balance credited. Prepaid multi-month terms can be upgraded at any time; downgrades apply at renewal.
What do you store about our traffic, and where?
Click verdicts and the signals behind them, plus integrity results and your own configuration, in the region you select at signup — US, EU or AP. We do not store offer data, creatives or the contents of your pages. Raw request logs are kept 30 days for abuse investigation; Enterprise plans can pin every component to a single jurisdiction.
Support

Talk to the team

Traffic questions rarely fit a ticket form. Reach us however suits — most replies land well inside 24 hours.

Email us Cloakshield.pro@outlook.com Telegram Direct chat with the support team
Enterprise support24 / 7 · named engineer
Professional supportMon–Fri · 8 h response
Starter supportMon–Fri · 24–48 h
Security incidents24 / 7 · all plans

Thanks — your message is with the support team. Expect a reply within 24–48 hours, sooner on Professional and Enterprise plans.

By sending this you agree to our privacy notice. We use your details to answer the enquiry and nothing else.

Point one campaign at it and read the verdict log.

A single CNAME, one live campaign, and a week of scored clicks tells you more than any deck. Your router keeps running exactly as it does today.

Create an account Ask a question