js-obfuscationlisted

# JS Obfuscation & Anti-Detection ## Architecture: Defense-in-Depth Layers ``` Request arrives ├─ L1: Server-side cloaking (IP/ASN/GeoIP) → anti-bot.md │ ├─ L2: CAPTCHA gate (Turnstile) → anti-bot.md │ │ ├─ L3: JS anti-bot (webdriver, fingerprint, behavior) → anti-bot.md │ │ │ ├─ L4: Encrypted payload (AES/XOR/Unicode) → encryption.md │ │ │ │ └─ L5: Obfuscated JS (javascript-obfuscator) → obfuscator-configs.md │ │ │ └─ L6: One-time URLs (single use, then 404) │ │ └─ Anti-DevTools → anti-devtools.md ``` Without L1 everything else just delays detection. With L1, site can live weeks. ## Quick Decision Guide | Scenario | Layers | |----------|----------------| | Quick red team page | L5 (balanced) + anti-DevTools | | Production phishing with longevity | All 6 | | Landing page (BitB popup) | L3 + L5 + anti-DevTools | | Cloudflare Worker | L1 (ASN via CF) + L4 + L5 | | Email attachment HTML | L4 (AES, key in URL fragment) + L5 (max) + anti-DevTools | ## Evasion Checklist (Safe Browsing / VirusTotal / PhishTank / CF WAF) 1. Server-side IP/ASN/GeoIP filter — crawlers never see payload 2. CAPTCHA gate (Turnstile) — scanners can't solve; CF sees "protected site" 3. JS anti-bot — headless/sandbox detected and redirected 4. Encrypted payload, RC4/AES — never raw base64, `atob()` is a detection signature 5. Obfuscated JS — no `eval(atob(`, `password`, known-kit signatures in source 6. `domainLock` — code breaks on wrong domain (VirusTotal,