This product was not featured by Product Hunt yet. It will not be visible on their landing page and won't be ranked (cannot win product of the day regardless of upvotes).
Product upvotes vs the next 3
Waiting for data. Loading
Product comments vs the next 3
Waiting for data. Loading
Product upvote speed vs the next 3
Waiting for data. Loading
Product upvotes and comments
Waiting for data. Loading
Product vs the next 3
Loading
whack.sh
Whack the moles your current scanner can't see.
Per the FBI's IC3 warning, TDS kits fingerprint IPs to hide payloads, targeting only residential, mobile, or specific ASNs. To catch them, you have to blend in. whack.sh allows you to scan any URL via datacenter, residential, mobile, VPN and BYO egress options at once. Then diffs the captures to expose cloaking, TDS, phishing sites and malware a datacenter-only IP scanner misses. Datacenter egress is free (first 5MB/scan); our curl API drives every tier, free or paid.
In June, the FBI’s IC3 released a PSA warning that malicious Traffic Distribution Systems (TDS) are bypassing traditional defenses by aggressively filtering visitors based on IP and device data to hide their final payloads.
If your threat intel relies on datacenter-bound scans alone, you're only seeing what the threat actor wants you to see. Modern phishing and TDS kits fingerprint ASNs to serve a clean face to scanners, revealing the real payload only to residential and mobile users, or to a specifically targeted ASN (for phishing, malware, or other attacks).
To catch them, you have to blend in.
That's why I built whack.sh. Drop in a single URL, and it triggers a simultaneous fan-out across datacenter, residential, mobile, VPN, and BYO egress options. Full request waterfall and redirect/TDS chain is captured for each path—then diffs the results to expose the cloaking instantly to detect the hidden payloads (malware, phishing, viruses, scareware, etc.).
whack.sh was submitted on Product Hunt and earned 7 upvotes and 1 comments, placing #51 on the daily leaderboard. Per the FBI's IC3 warning, TDS kits fingerprint IPs to hide payloads, targeting only residential, mobile, or specific ASNs. To catch them, you have to blend in. whack.sh allows you to scan any URL via datacenter, residential, mobile, VPN and BYO egress options at once. Then diffs the captures to expose cloaking, TDS, phishing sites and malware a datacenter-only IP scanner misses. Datacenter egress is free (first 5MB/scan); our curl API drives every tier, free or paid.
On the analytics side, whack.sh competes within SaaS, Business Intelligence and Security — topics that collectively have 50.1k followers on Product Hunt. The dashboard above tracks how whack.sh performed against the three products that launched closest to it on the same day.
Who hunted whack.sh ?
whack.sh was hunted by Daniel J. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
For a complete overview of whack.sh including community comment highlights and product details, visit the product overview.
Daniel J
In June, the FBI’s IC3 released a PSA warning that malicious Traffic Distribution Systems (TDS) are bypassing traditional defenses by aggressively filtering visitors based on IP and device data to hide their final payloads.
If your threat intel relies on datacenter-bound scans alone, you're only seeing what the threat actor wants you to see. Modern phishing and TDS kits fingerprint ASNs to serve a clean face to scanners, revealing the real payload only to residential and mobile users, or to a specifically targeted ASN (for phishing, malware, or other attacks).
To catch them, you have to blend in.
That's why I built whack.sh. Drop in a single URL, and it triggers a simultaneous fan-out across datacenter, residential, mobile, VPN, and BYO egress options. Full request waterfall and redirect/TDS chain is captured for each path—then diffs the results to expose the cloaking instantly to detect the hidden payloads (malware, phishing, viruses, scareware, etc.).
See the full architecture: https://whack.sh/how-it-works