Invisible to bots.
Unstoppable for creators.
Every request hits a 19-layer gauntlet at the Cloudflare edge before it ever reaches a link. Scrapers, crawlers and headless bots are scored and stopped in single-digit milliseconds. Real fans pass through untouched.
19 concentric defense layers.
One request at a time.
A request enters from the outside and runs the pipeline ring by ring. Each layer adds a threat score; the moment the running total crosses 75, the pipeline short-circuits and the bot dies on that ring. Hover a ring to inspect it — click to pin the detail.
How Instagram's crawler dies —
and your fan walks right in.
Two clients hit the exact same link at the exact same moment. facebookexternalhit is Instagram's in-app preview crawler. It can read HTML, but it cannot execute JavaScript — which is the one thing L5 demands.
facebookexternalhit — logged, low base score.AS32934), not a residential network. Score climbs.Sec-Fetch-* and Client-Hint headers a real browser always sends.sl_session cookie. Threshold crossed.sl_session cookie.Every scanner that touches your link.
Social platforms scan link-in-bio URLs before fans ever see them. StealthLink recognizes each crawler, decides what it's allowed to see, and serves a clean decoy — your real funnel stays invisible to the platform.
Built to outlast the next crawler
Detection rules live as edge config — UA regex sets, ASN lists and KV threat-intel. When a platform ships a new crawler or rotates IP ranges, you add a pattern or a KV entry and it's live across every edge PoP in seconds, no core redeploy. L18 cross-client reputation and L19 ML ensemble catch unnamed crawlers by behavior before anyone knows their name — and per-creator rotating domain pools mean a burned domain never burns the network.
The view from the edge.
Every verdict is logged to Cloudflare D1 the instant it's made. This is a simulated feed shaped exactly like production — real bot signatures, real verdicts, real layers.
Threat origin radarscanning
Bot block effectiveness
Kills by layer
Verdicts · last 24hblockchallengeallow
Where a click actually goes.
The DeepLink engine and the 19-layer Edge worker talk over an in-network service binding — zero added latency. Click data is written to D1 asynchronously via waitUntil(), so scoring never waits on the database. Hover any node.
Defensible by design.
StealthLink decides bot-vs-human from server-side request metadata only. There is no client-side fingerprinting anywhere in the stack — which is exactly why the privacy and biometric exposure stays low.
What we process (server-side)
- User-Agent string & request headers
- ASN, country & city (Cloudflare
cfobject) - TLS version, cipher & JA3 handshake
- Request cadence & timing (transient KV)
- IP — salted SHA-256, per link, never raw in D1
What we never touch
- Canvas fingerprinting
- WebGL / GPU renderer probes
- AudioContext fingerprinting
- Font enumeration · mouse / pointer telemetry
- WebRTC IP leakage · any biometric data
Nobody else builds the wall this high.
Other link-in-bio tools optimize for pretty pages. StealthLink optimizes for not getting your creators deplatformed.
| Capability | StealthLink |
StealthCreator | Linko | GetAllMyLinks |
|---|