CloakerHQ

TikTok Ads

TikTok ads cloaking

TikTok is the easiest of the three big platforms to separate from real traffic, because its review system makes no attempt to look like a person. Here is exactly what it sends, and what CloakerHQ does with it.

https://yoursite.com/lp/?utm_campaign=…&ad_id=…

TikTok's scanner

ByteDance's own network, announcing itself in the user agent, running no scripts.

The compliant page. Caught at layer one, and it would not have run the swap anyway.

Your TikTok audience

Mobile carriers and the in-app browser, scripts executing, campaign parameters intact.

The offer page, on the same URL.

What TikTok's review traffic looks like

All of it arrives on ByteDance's own network, from a rotating set of addresses, announcing itself plainly in the user agent. Nothing about it is disguised, and those same user agents appear nowhere else on any other network.

The timing is human. Requests cluster into a working day in Singapore and Beijing, so somebody is on shift. And because the scanner preserves your campaign parameters, you can tie each review hit back to the ad that triggered it.

Two consequences we build on. Network attribution alone is sufficient for TikTok, so layer one resolves it before your page renders. And because this scanner almost never executes page scripts, a filter that needs a browser fingerprint to see it would never see it.

What CloakerHQ does about it

Matches the network, not the string

A user agent is trivially copyable and every competitor's scraper copies it. The stable fact is that these requests come from ByteDance's own autonomous systems, so that is what layer one matches; the agent string only ever confirms.

Fails towards the compliant page

The offer is swapped in by script, so anything not executing scripts sees the compliant page without a rule having to identify it. For this scanner that is nearly everything.

Logs what it filtered and why

In-app browser traffic is irregular enough that over-filtering is the real risk on this platform. You see every filtered visit with its reason, so hiding your offer from buyers shows up as a number rather than as a bad week.

What it does not do is make the compliant page for you, and on this platform that is the part that decides outcomes. A page that cannot stand on its own is the flag, whatever filter sits in front of it.

A filter log listing visits with their origin, the reason each was filtered, which layer decided, and which page was served
Every filtered visit with its reason, so over-filtering shows up as a number rather than as an unexplained drop in conversion.

Pricing

Starter

$49 / mo

  • 1 site
  • 50,000 filtered visits a month

One offer, one landing page, one traffic source.

Scale

$199 / mo

  • Unlimited sites
  • 1,000,000 filtered visits a month

Agencies and media buyers running for more than one advertiser.

What each tier includes.

Questions

Does TikTok hide its review crawler?
No. Every review request we have logged arrived on ByteDance's own network and announced itself in the user agent. TikTok is the one platform where network attribution alone is enough.
Does the TikTok scanner run JavaScript?
Almost never. Because CloakerHQ swaps the offer in with JavaScript, the scanner sees the compliant page whether or not a rule recognises it.
Can I tell which campaign is being reviewed?
Usually yes, and you will see it in the log. TikTok's scanner keeps your tracking parameters, so a review hit ties back to the ad that triggered it.
Will it block my real TikTok traffic?
That is the failure we instrument against. TikTok traffic arrives through mobile carriers and the in-app browser, which looks irregular in ways naive filters punish: missing referrers, odd viewports, aggressive prefetching. Every filtered visit is logged with its reason so you can see if the filter is eating buyers.
How much is it?
$49 a month for one site, $99 for five, $199 for unlimited sites. Campaigns are unlimited at every tier.

Join the waitlist

There is nothing to sign into yet. Leave an email and we will write once the private beta opens, with setup notes for the traffic source you run.

One email when it opens. Nothing else, and you can reply to be removed.