You verified the page the cloaker picked.
Cloaked offers, house passbacks and pre-auction IVT filtering all come back as well-formed pages, so wrong data ships unchallenged.
A slot you cannot verify returns a clean 200. Nothing in the log says the market went unchecked.
Every market returned the creative, the advertiser domain and the click chain behind it.
Sample placements across six markets, illustrative. What is real: an unverifiable slot returns a clean 200.
The violation passes review, the report says clean
The affiliate's TDS can score your exit's ASN against a proxy-reputation feed and serve the white page. If the datacenter exit never reaches the auction, the slot fills with a house passback your pipeline logs as an empty market. Both come back as a well-formed 200, nothing errors, nothing gets retried, and the wrong conclusion ships.
Filtered as GIVT before the auction→Residential and mobile in one pool
Datacenter ASNs can be classified as non-human by GIVT filters and can carry hosting flags in commercial IP databases, so the exit may be dropped before a bid request exists. You measure the house fallback.
One endpoint fronts residential, mobile and datacenter exits. The edge picks per target and you are billed per GB whatever it lands on, so archive sweeps and publisher renders share one credential at one rate.
The white page is a real page→Reputation scored per target, per hop
A TDS can score ASN and IP reputation, then referrer and headers, before deciding to write bland HTML. Status 200, plausible content, nothing in your diff to catch it. The address is the input you can change.
The edge tracks how each target is currently receiving each exit — publisher, ad server, click tracker and offer host scored separately — and stops routing you through exits that target treats as suspect.
Rotation breaks the click chain→One machine, one exit, one chain
Ad server to click tracker to TDS to offer host, each hop setting cookies. A pool that rotates per connection changes address mid-chain, which is a signature affiliate anti-fraud can flag.
Ask the operator to put your account in sticky mode and every connection from that machine leaves by the same exit — 600 seconds by default, raised on request. A second chain in parallel needs a second machine.
Geo databases disagree with each other→Country on the username, checked by you
A DSP targets off one commercial geo database, your pool's country label comes from another, and no response tells you they disagreed. You log a campaign that was never targeted where you think you looked.
Append -country-us and the connection leaves the US; drop the suffix and the country saved in your portal applies. Every market in a campaign costs the same per GB as one, with no geo surcharge.
Before you point a crawler at it.
A cloaked page returns 200 with the wrong content. How does an automatic re-run know anything stumbled?
It does not, and no proxy can: a cloaked page is a clean 200 with a plausible body, no network layer sees the difference, and its bytes are billed like any other response. What you control is the exit — pull the same URL from two countries, or twice with -rotate on the username so the second connection takes a different exit, diff what came back, and put a field check in front of the report.
Isn't measuring through proxies just generating invalid traffic and hurting the publisher?
Sampling public ad delivery at a rate the target tolerates is ordinary verification practice. Fabricating impressions or clicking paid units at volume is not, and our AUP forbids the aggressive pattern that generates abuse reports. We are the egress layer: your methodology, your rate limits, your disclosure. If you need volume that distorts a publisher's numbers, we are the wrong supplier.
The IP is one signal out of twenty. You don't fix timezone, canvas or JA4.
Correct. It is a plain proxy endpoint: no SDK, no injected JavaScript, no header rewriting, nothing added to your traffic. The client stack stays yours. Match Intl timezone, Accept-Language and UA to the exit's country, or the mismatch will out you no matter how clean the address is. Scrapy, curl, Go net/http and Chromium-based browsers all take the endpoint as-is, with the credentials in the proxy URL.
Can I hold several pinned identities at once from one box?
No. Stickiness is an account mode the operator sets, and the key is your source IP: every connection from one machine leaves through the same exit until it has been idle for 600 seconds (the default). There is no session-id parameter on the username, so you cannot request a second pin from the same box. Run parallel chains from separate machines, or add -rotate to the username for a new exit per connection and treat each chain as independent.
Headless rendering with video creatives burns bandwidth. What does this actually cost me?
It is heavy: VAST creatives and full ad-stack renders dominate the bill. Block fonts and non-ad third parties, keep every ad call. Residential, mobile and datacenter sit behind one endpoint at one rate, so an ads.txt or sellers.json sweep costs the same per gigabyte as a publisher render and weighs far less. Metered plans bill a flat rate per gigabyte — current rates are on the pricing page.
One credential, every job.
All six →Run the diff before it reaches the client report
Take one offer URL and one publisher page, pull each from two exits on the free 1 GB, and compare what came back. That is the whole evaluation, and it costs nothing.
Get 1 GB free