JS Obfuscation & Anti-Detection
Architecture: Defense-in-Depth Layers
Request arrives
├─ L1: Server-side cloaking (IP/ASN/GeoIP) → anti-bot.md
│ ├─ L2: CAPTCHA gate (Turnstile) → anti-bot.md
│ │ ├─ L3: JS anti-bot (webdriver, fingerprint, behavior) → anti-bot.md
│ │ │ ├─ L4: Encrypted payload (AES/XOR/Unicode) → encryption.md
│ │ │ │ └─ L5: Obfuscated JS (javascript-obfuscator) → obfuscator-configs.md
│ │ │ └─ L6: One-time URLs (single use, then 404)
│ │ └─ Anti-DevTools → anti-devtools.md
Without L1 everything else just delays detection. With L1, site can live weeks.
Quick Decision Guide
| Scenario |
Layers |
| Quick red team page |
L5 (balanced) + anti-DevTools |
| Production phishing with longevity |
All 6 |
| Landing page (BitB popup) |
L3 + L5 + anti-DevTools |
| Cloudflare Worker |
L1 (ASN via CF) + L4 + L5 |
| Email attachment HTML |
L4 (AES, key in URL fragment) + L5 (max) + anti-DevTools |
Evasion Checklist (Safe Browsing / VirusTotal / PhishTank / CF WAF)
- Server-side IP/ASN/GeoIP filter — crawlers never see payload
- CAPTCHA gate (Turnstile) — scanners can't solve; CF sees "protected site"
- JS anti-bot — headless/sandbox detected and redirected
- Encrypted payload, RC4/AES — never raw base64,
atob() is a detection signature
- Obfuscated JS — no
eval(atob(, password, known-kit signatures in source
domainLock — code breaks on wrong domain (VirusTotal, sandboxes)- One-time URLs — reported link is already 404
- Domain rotation — flagged → reserve; aged domains (.com, 2+ years) flagged slower
- Delayed execution —
setTimeout 3–5s; scanner budgets are short
- Interaction-gated — real click/scroll required before payload
- Polymorphic mutation — same code for every visitor → signatures
- Email whitelist (Cephas pattern) — serve only if email matches target list
- Legit hosting (
.workers.dev, .pages.dev, .netlify.app) = high reputation; Workers/Pages get less scrutiny
Does NOT work: client-side blocking of safebrowsing.googleapis.com — checks happen at browser level before page JS.
What to Obfuscate
Yes: tracking scripts, form handlers, exfil logic, CF Worker code, custom frontend JS.
No: server-side code, Nginx/HAProxy configs, CSS, HTML structure, proxied content, Docker internals.
One-Time URLs
active = {}
@app.route('/<token>')
def land(token):
if token in active:
del active[token]
return render_page()
return '', 404
Common Mistakes
- Obfuscation without server-side filtering
base64 instead of RC4/AES — atob() is a signature- Hardcoded URLs in source — construct dynamically or decrypt at runtime
- No
domainLock — code runs on VirusTotal → flagged
renameGlobals: true without testing — breaks external scripts- No mouse check — sandboxes bypass webdriver but don't move mouse
- Static CAPTCHA — if cached forever, scanner reuses session
- Same code for every visitor — polymorphic mutation prevents signatures
Reference Files
obfuscator-configs.md — javascript-obfuscator presets (balanced/max/light), CLI, optionsanti-bot.md — anti-bot, anti-sandbox, CDP detection, server-side cloaking, Turnstileanti-devtools.md — 7 methods, disable-devtool npmencryption.md — AES-256-GCM, XOR, invisible Unicode, DOM cloaking, polymorphic JSphaas-reference.md — 11 PhaaS kits (2025-2026), techniques, stats
1---2name: js-obfuscation3description: Use when obfuscating JavaScript, building anti-detection layers, evading Google Safe Browsing, hiding payloads from scanners, adding anti-bot/anti-DevTools protection, or preparing phishing/red-team pages for deployment4---56# JS Obfuscation & Anti-Detection78## Architecture: Defense-in-Depth Layers910```11Request arrives12 ├─ L1: Server-side cloaking (IP/ASN/GeoIP) → anti-bot.md13 │ ├─ L2: CAPTCHA gate (Turnstile) → anti-bot.md14 │ │ ├─ L3: JS anti-bot (webdriver, fingerprint, behavior) → anti-bot.md15 │ │ │ ├─ L4: Encrypted payload (AES/XOR/Unicode) → encryption.md16 │ │ │ │ └─ L5: Obfuscated JS (javascript-obfuscator) → obfuscator-configs.md17 │ │ │ └─ L6: One-time URLs (single use, then 404)18 │ │ └─ Anti-DevTools → anti-devtools.md19```2021Without L1 everything else just delays detection. With L1, site can live weeks.2223## Quick Decision Guide2425| Scenario | Layers |26|----------|----------------|27| Quick red team page | L5 (balanced) + anti-DevTools |28| Production phishing with longevity | All 6 |29| Landing page (BitB popup) | L3 + L5 + anti-DevTools |30| Cloudflare Worker | L1 (ASN via CF) + L4 + L5 |31| Email attachment HTML | L4 (AES, key in URL fragment) + L5 (max) + anti-DevTools |3233## Evasion Checklist (Safe Browsing / VirusTotal / PhishTank / CF WAF)34351. Server-side IP/ASN/GeoIP filter — crawlers never see payload362. CAPTCHA gate (Turnstile) — scanners can't solve; CF sees "protected site"373. JS anti-bot — headless/sandbox detected and redirected384. Encrypted payload, RC4/AES — never raw base64, `atob()` is a detection signature395. Obfuscated JS — no `eval(atob(`, `password`, known-kit signatures in source406. `domainLock` — code breaks on wrong domain (VirusTotal, sandboxes)417. One-time URLs — reported link is already 404428. Domain rotation — flagged → reserve; aged domains (.com, 2+ years) flagged slower439. Delayed execution — `setTimeout` 3–5s; scanner budgets are short4410. Interaction-gated — real click/scroll required before payload4511. Polymorphic mutation — same code for every visitor → signatures4612. Email whitelist (Cephas pattern) — serve only if email matches target list4713. Legit hosting (`.workers.dev`, `.pages.dev`, `.netlify.app`) = high reputation; Workers/Pages get less scrutiny4849Does NOT work: client-side blocking of `safebrowsing.googleapis.com` — checks happen at browser level before page JS.5051## What to Obfuscate5253**Yes:** tracking scripts, form handlers, exfil logic, CF Worker code, custom frontend JS.54**No:** server-side code, Nginx/HAProxy configs, CSS, HTML structure, proxied content, Docker internals.5556## One-Time URLs5758```python59active = {}6061@app.route('/<token>')62def land(token):63 if token in active:64 del active[token]65 return render_page()66 return '', 40467```6869## Common Mistakes70711. Obfuscation without server-side filtering722. `base64` instead of RC4/AES — `atob()` is a signature733. Hardcoded URLs in source — construct dynamically or decrypt at runtime744. No `domainLock` — code runs on VirusTotal → flagged755. `renameGlobals: true` without testing — breaks external scripts766. No mouse check — sandboxes bypass webdriver but don't move mouse777. Static CAPTCHA — if cached forever, scanner reuses session788. Same code for every visitor — polymorphic mutation prevents signatures7980## Reference Files8182- `obfuscator-configs.md` — javascript-obfuscator presets (balanced/max/light), CLI, options83- `anti-bot.md` — anti-bot, anti-sandbox, CDP detection, server-side cloaking, Turnstile84- `anti-devtools.md` — 7 methods, disable-devtool npm85- `encryption.md` — AES-256-GCM, XOR, invisible Unicode, DOM cloaking, polymorphic JS86- `phaas-reference.md` — 11 PhaaS kits (2025-2026), techniques, stats
sergeyizmailov