Ad network bots tend to concentrate on identifying signs that are usually associated with automation and policy violations such as IP/ASN reputation, user-agent and header information, JavaScript execution, fingerprinting, and interaction timing. Modern cloaking solutions protect themselves from each of those factors by filtering dangerous traffic, checking for valid fingerprints, scoring sessions, and redirecting suspicious users to a safe page.
Key takeaway: Modern cloakers do not just hide content; they analyze risk signals in real time and decide whether a visitor should see the offer or a policy-safe page.
How Ad Platform Crawlers Work in 2026
The reviewer bot vs the ranking bot.
Special crawlers, such as Google’s AdsBot and review bots, crawl landing pages, run JavaScript code, and perform checks for policy conformity before and during advertising campaigns. The crawlers are not just reading HTML; they execute JS, analyze header information, and navigate through pages as users in order to detect cloaking, deceptive behavior, or offers that violate policies.
What Signals Trigger Manual Review or Disapproval
Crawlers and automated systems flag pages when they detect:
- Data centre or proxy IPs, suspicious ASNs, and known reviewer subnets
- Bot-like user-agents, missing or odd headers, or inconsistent fetch patterns
- Headless or automation flags in JS, impossible timers, or render quirks
- Unstable or suspicious device fingerprints such as screen, locale, canvas/WebGL
- Robotic navigation: identical paths, millisecond-stable timing, and no human errors
- Redirect chains and inconsistent content by URL or visitor type
When enough signals cross a threshold, the ad or account is sent to manual review or disapproved.
What Ad Platform Crawlers Actually Look For
1. IP Address and Network Reputation
The crawler and risk system verify whether the source of traffic comes from targeted residential or mobile ISPs, or from data centre, proxy, and VPN ranges commonly used by bot farms. Reviewer traffic usually originates from targeted ASNs and ranges associated with ad operations or security.
Modern ad cloaker solutions counter this by:
- Keeping up-to-date lists of risky IPs and ASNs from data centres
- Accepting only targeted geos and valid ISP ranges
- Redirecting traffic from blocked IPs and non-targeted geos to a safe landing page
2. User-Agent and HTTP Headers
Farms and bots often have generic or old user-agents, no referer, or unusual accept-language and header orders that do not match a normal browser. Crawling systems verify these characteristics based on expected patterns for Chrome, Safari, and mobile browsers.
Ad cloaker countermeasures:
- Recognizing bot-like UAs and header anomalies
- Serving a clean and compliant landing page to such profiles
- Redirecting other browser profiles to the money page
3. JavaScript Runtime and Headless Detection
Today’s crawlers render JavaScript and look for evidence of headless browsers, automation suites such as Selenium or Puppeteer, or impossible timings such as instantaneous page loads and zero network latency. They can also verify browser properties that a real browser exposes but bots tend to fake poorly.
Countermeasures for cloaker:
- Client-side tests to detect headless browser or automation suite use
- Time and environment tests for assessing bot-likeness
- Re-routing sessions at risk to safe pages before any restricted content loads
4. Device Fingerprint and Consistency
The platforms create a fingerprint from factors such as screen size, OS, locale, time zone, fonts, canvas/WebGL results, and more. They also look for the same device IDs across multiple sessions.
Countermeasures for cloaker:
- Collecting fingerprint data and creating a consistent device ID
- Removing duplicates and slowing suspicious devices down
- Updating routing policy based on fingerprint risk
5. Behavioural and Navigation Patterns
Click paths, scroll behaviour, dwell time, form filling, and error handling are some of the metrics used by crawlers and machine-learning models to understand user behaviour. Bot networks are usually characterized by repetitive activity, perfect timing, or excessively spaced activity.
Cloaker countermeasures:
- Monitoring the timing of user activities, scrolling, and clicks
- Generating behavioural scores and eliminating poor-quality or bot sessions
- Serving safe pages to traffic failing behavioural thresholds
6. URL Structure and Redirection
Reviewers assess the redirect chain length and the end result of the landing page. Content variations depending on parameters or referrers are considered policy violators.
Cloaker countermeasures:
- Maintaining short and visible redirect chains for humans
- Using similar URL structures between the safe page and money page
- Using policy-compliant URLs for reviewer-like traffic
How Modern Ads Cloaker Systems Counter Each Signal
The modern cloaking ads system becomes the decision-making engine for traffic. It analyzes all visits for signs of bot and human review traffic, calculates a risk score, and either directs a session to the policy-compliant safe page or the money page.
Multi-signals-based traffic decision-making engine
A modern cloaking ads system becomes the real-time decision-making engine.
- Process all traffic with analysis of IPs, user agents, headers, JavaScript context, and fingerprints.
- Calculate the risk score for each session based on rules and heuristic approaches such as IP risk and bot signs.
- Send low-risk traffic to the money page; high-risk and reviewer-like traffic goes to the safe page.
Link Cloaking as an Additional Layer
Link cloaking comes before the landing page. It hides the final destination and implements rules based on links:
- Geography and device rules before the landing page loads
- Routing based on source such as Facebook, Google, or native
- Additional hiding of the landing URL from scrapers and spy tools
Link cloaking combined with on-page cloaking will limit the visibility of the offer and create one more filter for potential bad traffic.
Safe-Page Design That Fits the Ad Claims
To avoid policy problems, the safe page should:
- Represent the same offer and claims as the ad
- Have the same creatives, headings, and value proposition
- Be free of obvious doorway pages or irrelevant content
This helps pass manual review while still protecting the real funnel from risky traffic.
Google Ads Cloaking: Compliant Traffic Filtering vs Policy-Violating Deception
That is, the traffic filtering that complies with policy will not show anything except the offer to people in the target geo, while the traffic filtering that violates policy is aimed at deceiving the Google reviewers by providing a different page for them.
Compliant traffic filtering (it can be okay if done properly)
The compliant approach is based on filtering for traffic safety:
- Bot/crawler filtering: detecting and blocking DC IPs, crawlers, and reviewer IPs so that none of them sees the money page.
- Geo/ISP filtering: allowing traffic from target geos and trusted residential/mobile ISPs only; all other visitors see a neutral page.
- Consistent content for humans: all real users in allowed geos see the same core offer, claims, and landing experience.
- Safe page that matches the ad: if you use a safe page for high-risk profiles, it should still reflect the ad’s message and not look like a fake reviewer-only site.
This approach is often described as “smart filtering” rather than true cloaking: you are protecting campaigns from invalid traffic and over-aggressive review behaviour without misleading Google.
Policy-violating deception (against Google Ads policies)
Google’s Misrepresentation policy clearly states that displaying different content in order to manipulate its systems is not allowed:
- Different page for reviewers: serving a safe or bridge page to Google bots or reviewers while presenting a different page to the actual user.
- Manipulation of content: manipulating important information such as terms, offers, or pricing depending on the visitor in order to get approval and serve it to actual users.
- Intentional attempt at violating the policy: using cloaking to run offers that would have been rejected otherwise.