You set up the cloaker, activated filtering, and campaigns are running. But when was the last time you opened your cloaking logs to understand what’s happening behind the numbers?
Most affiliates treat the cloaker as a black box. Set it up, turn it on, forget about it. Meanwhile, cloaking logs accumulate data that reveals exactly why some campaigns scale and others stall. Review patterns, bot peak hours, GEOs with inconsistent filtering, and traffic sources sending more crawlers than real buyers.
Interpreting cloaking logs is what separates the operator who reacts from the one who anticipates. And in 2026, with platforms intensifying automated reviews, anticipating is the only way to keep accounts healthy while volume grows.
What cloaking logs are and why most operators ignore them
Cloaking logs are detailed records of every decision the cloaker makes. Every click that reaches your domain generates a log entry with visitor information: IP address, user-agent, HTTP headers, browser fingerprinting result, origin GEO, access time, and the final decision (Safe Page or Money Page).
These records are the X-ray of your operation. They show who’s accessing, from where, how often, and how the cloaker is responding. But most operators never open the logs because they don’t know what to look for.
The result is predictable: filtering issues go unnoticed until an account gets banned. And when the ban comes, the operator has no data to understand what happened, let alone prevent it next time.
What data cloaking logs record
Each log entry contains specific fields that, when analyzed together, tell the complete story of every access:
● Origin IP: identifies the visitor’s location and provider. Datacenter IPs indicate bots. Residential IPs indicate real traffic.
● User-agent: string that identifies the browser and operating system. Known crawler user-agents are filtered automatically. Generic or missing user-agents are bot signals.
● Fingerprint result: the fingerprinting score (Canvas, WebGL, AudioContext, fonts, screen resolution) that determined whether the visitor is human or bot.
● Cloaker decision: Safe Page or Money Page. This field is the most important for performance analysis.
● Timestamp: exact date and time of access. Allows identification of temporal review patterns.
● GEO: visitor’s country and region. Allows segmenting analysis by market.
● Referrer: where the click came from (Meta Ads, Google Ads, TikTok Ads, direct traffic).
● Decision latency: time the cloaker took to process filtering. Should be under 50ms.
How to read cloaking logs to find problems before they become bans
Bot access spikes at specific times
If logs show a concentration of filtered accesses (directed to Safe Page) at specific times, it indicates the platform is running scheduled reviews. Knowing the schedule allows you to prepare updated Safe Pages before review windows and avoid making Money Page changes during those periods.
Sudden increase in filtering rate
If pass-through rate drops from 99% to 90% in one day, something changed. The platform may have updated its crawlers, a new bot may be accessing without proper detection, or a specific campaign may be attracting manual review. The logs show exactly which traffic source and which GEO generated the filtering increase.
Recurring false positives
False positives happen when the cloaker directs real traffic to the Safe Page by mistake. In the logs, these cases appear as accesses with legitimate fingerprints (residential IP, real browser user-agent, high fingerprint score) that were still filtered. If this is happening frequently, the cloaker’s sensitivity settings need adjustment.
Reviewers passing through filtering
The opposite scenario: the log shows accesses with bot characteristics (datacenter IP, generic user-agent) that were directed to the Money Page. These are false negatives, and each one represents a real ban risk. If logs record false negatives, the cloaker’s bot database needs immediate updating.
Metrics you extract from cloaking logs to optimize campaigns
Logs don’t just serve to detect problems. They contain optimization data that no tracker can provide:
● Pass-through rate by GEO: identifies which markets have more review activity and which deliver cleaner traffic. GEOs with pass-through rate below 95% deserve investigation.
● Pass-through rate by platform: compares review intensity between Meta Ads, Google Ads, and TikTok Ads. Platforms with more bots require more aggressive filtering configuration.
● Average latency by time of day: if cloaker latency increases during peak hours, the server may be overloaded. Latency above 50ms affects the real buyer’s experience and increases abandonment rate.
● Re-scan volume per account: accounts receiving many re-scans are under elevated scrutiny. The logs reveal how many times the platform returned to verify the same URL.
● User-agent distribution: shows which crawlers are accessing most frequently. New crawlers not in the cloaker’s database need to be added.
How to use cloaking logs to adjust Safe Pages
Logs reveal reviewer behavior on the Safe Page. If the log shows a reviewer accessed the Safe Page and navigated through 4 internal pages in 3 minutes, the Safe Page is convincing. If the reviewer accessed and left in 2 seconds, it could be an automated scan or the Safe Page needs more content.
Log data that guides Safe Page adjustments:
● Bot dwell time: Safe Pages with average dwell time below 5 seconds for human reviewers need more content and internal navigation.
● Internal pages accessed: if reviewers are clicking Safe Page links, it needs functional links leading to real content, not 404 pages.
● Return frequency: if the same reviewer IP returns multiple times over days, the platform is monitoring the URL. Consider rotating the domain.
Cloaking logs and tracker integration
Cloaking log data gains power when cross-referenced with your tracker data. Integration between the cloaker and trackers like RedTrack, Voluum, Binom, or ClickMagick enables a complete view:
● Cloaking log shows: who was filtered, who passed through, latency, GEO, fingerprint
● Tracker shows: conversion, CPA, ROI, sales funnel
Cross-referencing both, you identify scenarios like: “Germany GEO has 99.5% pass-through rate in the cloaker but CPA 40% above average in the tracker.” This indicates traffic is passing through clean, but the offer or creative isn’t converting in that market. The problem isn’t filtering, it’s positioning.
Without cross-referencing data, you’d adjust the cloaker when you should be adjusting the creative. With integrated data, every decision is informed.
Alert automation based on cloaking logs
Monitoring logs manually works for small operations. For those running multiple accounts and multiple GEOs, automated alerts are necessary:
● Pass-through rate drop alert: if the rate drops below 97% on any account, the system notifies immediately.
● High latency alert: if filtering latency exceeds 100ms for more than 5 minutes, something is wrong with the server or CDN.
● New user-agent alert: if an unknown user-agent appears frequently, it may be a new crawler that needs to be added to the database.
● Intensive re-scan alert: if a URL receives more than 10 re-scans in 24 hours, the account is under active investigation.
The White Rabbit and cloaking log analysis
The White Rabbit (TWR) offers a complete log panel that transforms raw data into actionable information.
TWR’s dashboard segments logs by account, domain, GEO, and platform. Every access is recorded with all analysis fields (IP, user-agent, fingerprint, decision, latency, timestamp) and can be filtered, exported, and cross-referenced with integrated tracker data.
With edge-first filtering and consistent latency under 50ms, TWR processes every filtering decision with precision and records the result in real time. The pass-through rate above 99% is verifiable directly in the logs, account by account.
Native integration with RedTrack, Voluum, Binom, and ClickMagick allows filtering data and conversion data to be analyzed in a single flow.
Starting at US$97/month with 20,000 clicks included.
Frequently asked questions about cloaking logs
Do I need to analyze cloaking logs every day?
For operations spending above US$1,000/day, yes. Daily cloaking log analysis identifies problems before they become bans. For smaller operations, a weekly analysis is sufficient, as long as automated alerts are configured for anomalies.
What do I do when logs show a new bot that isn’t being filtered?
Add the bot’s user-agent to the filtering list immediately. If the cloaker allows custom rules, create a rule based on the IP and user-agent pattern identified in the cloaking logs. In TWR, the bot database is updated automatically, but manual rules can be added for specific cases.
Can cloaking logs be used as evidence to dispute bans?
Not directly with platforms, because they would reveal the cloaking operation. But logs are fundamental for internal diagnostics. They show whether there was a leak (false negative that allowed a reviewer to reach the Money Page) and help correct configuration to prevent the same issue on the next account.
How long should I keep logs stored?
Keep at least 90 days of cloaking logs. Platform review patterns change over weeks, and having history allows you to identify trends. Older logs can be archived for quarterly comparative analysis.
Those who ignore cloaking logs operate in the dark. Those who read them operate with advantage.
Cloaking logs contain the complete map of your operation. Every access, every decision, every review pattern. Ignoring this data is running campaigns blindfolded and hoping the cloaker handles everything on its own.
Interpreting cloaking logs transforms data into decisions. And informed decisions are what separate operations that scale from operations that lose accounts without understanding why.
