canary

Server-side decided before any HTML is sent

Browser-side decided in JS, after the page loads

Plain-text report for tools that capture text, not DOM

CANARY -- CLOAKING EXPOSURE CHECK
time: 2026-07-21T19:19:02.351308+00:00
client: 216.73.217.68  GET / HTTP/1.1

SERVER-SIDE
  [INFO] TLS fingerprint (JA3)
         This hash identifies your TLS stack. Kits and CDNs match it against known-automation lists; it is stable across runs and independent of anything you set in HTTP.
         > JA3=7c4f2964e18b6f743c8ec9102a0c3210  negotiated=TLSv1.3 TLS_AES_256_GCM_SHA384  alpn=http/1.1
  [FLAG] TLS GREASE  +35
         The ClientHello contains no GREASE values. Every real Chrome and Firefox inserts them; Python, Go, curl and most automation stacks never do. With a browser user-agent this is conclusive proof the traffic is not from the browser it claims to be.
         > no GREASE in cipher suites or extensions
  [OK  ] TLS 1.3 support
         TLS 1.3 offered.
  [OK  ] ALPN
         Offers h2, as a browser does.
         > h2, http/1.1
  [OK  ] Cipher suite list
         10 cipher suites offered.
  [OK  ] SNI
         Matches the Host header.
         > canary.randomwisman.com
  [FLAG] User-Agent header  +35
         UA self-identifies as tooling ('Bot'). This alone is a block on most kits.
         > Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
  [INFO] Sec-CH-UA client hints
         Not applicable for this UA.
  [FLAG] Sec-Fetch-* metadata  +22
         No Sec-Fetch-Site/Mode/Dest/User. Every browser since 2020 sends these on a top-level navigation.
  [OK  ] Accept header
         Plausible.
         > */*
  [OK  ] Accept-Encoding
         Plausible.
         > gzip, br, zstd, deflate
  [FLAG] Accept-Language  +15
         No Accept-Language. Kits geo-gate on this and block when absent.
  [FLAG] Header order  +18
         Only 33% of Chrome's header orderings preserved. Header order is a stable client fingerprint and is cheap for a kit to check.
         > accept -> user-agent -> accept-encoding -> host
  [OK  ] Proxy / scanner headers
         No proxy or scanner headers leaked.
  [INFO] HTTP version
         HTTP/1.1. (This server is h1-only, so h2/h3 negotiation and JA3/JA4 TLS fingerprinting are not tested here -- see the notes below.)
         > HTTP/1.1
  [WARN] Referer  +10
         No Referer. Many kits only serve the payload when the referrer is a mail provider or link shortener, and show a decoy otherwise.
  [FLAG] Egress IP / ASN  +30
         Egress is a hosting/datacenter ASN. Residential victims never originate here, and datacenter ASN lists are the first filter in nearly every kit. This is the highest-value thing to fix.
         > 216.73.217.68  AS16509  AMAZON-02 - Amazon.com, Inc., US  rDNS=none
  [INFO] Cookie persistence
         First request -- reload this page to test whether cookies persist.

SERVER SCORE: 165 (critical) -- You will be cloaked. Analysis results are not trustworthy.

RAW REQUEST HEADERS (in order received)
  accept: */*
  user-agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
  accept-encoding: gzip, br, zstd, deflate
  host: canary.randomwisman.com