whack.sh

What it does

Per the FBI's IC3 warning, TDS kits fingerprint IPs to hide payloads, targeting only residential, mobile, or specific ASNs. To catch them, you have to blend in. whack.sh allows you to scan any URL via datacenter, residential, mobile, VPN and BYO egress options at once. Then diffs the captures to expose cloaking, TDS, phishing sites and malware a datacenter-only IP scanner misses. Datacenter egress is free (first 5MB/scan); our curl API drives every tier, free or paid.

Scan any URL from datacenter, residential and mobile egress at once. Expose the TDS cloaking, phishing and live malware that datacenter-only scanners miss.

Your browser can't play embedded video. Download the film (MP4, 7 MB) . Datacenter-only scanners have a tell. They run from a handful of cloud ASNs — AWS, GCP, Azure — and cloakers know every one. The moment a request arrives from a known scanner range, the traffic distribution system fingerprints the IP and serves a clean decoy: a parked page, a harmless redirect, a login form that does nothing. Your scanner records “benign” and moves on. The mole never surfaced. The malicious payload only renders for real users on real residential and mobile IPs — the exact view a datacenter scan can't reach. And it goes deeper: sophisticated kits fingerprint the visitor's ASN and tailor the…from whack.sh

• 
  Heyhack Scan2022 · auth.heyhack.com · ▲271

  SaaS pen-testing that surpasses the level of ethical hackers

• 
  StealthHoundJan 2026 · ▲196

  Your browser's blind spots, Exposed.

• 
  JA3.pro2023 · ▲93

  Bypass anti-bot systems by impersonating TLS fingerprint

• 
  Pingkat2023 · ▲72

  Continuously monitor your website's public resources

• 
  Browser-based XSS scanner2024 · github.com · ▲57

  This is a simple single-file python program that can find basic XSS (cross-site scripting) vulnerabilities in a target url. Most XSS discovery tools use a payload refelection strategy in which payloads are injected in url parameters and the GET response is inspected for places where the payload content is reflected. This is a very low precision XSS detection strategy because most reflection does not support execution. This program uses a different approach, and instead opens the target url in a browser, tests alert(...) payloads directly in the browser context, and listens for an alert being…

• 
  Dastardly2022 · portswigger.net · ▲57

  A lightweight web app security scanner for your CI pipelines

• 
  SimCity, but with Permits▲912

  A free city-building game in your browser. You are the mayor. You know what the city needs. Now get it past the zoning board, the neighbors, the appeals court and the next election.

  Life & fun · 2d ago · permit.petercai.com

• IV
  I've been paying for a rural Tanzanian's education for 10 years▲778

  Life & fun · 14d ago · tanzaniaeducationproject.org

• 
  Bigwords.page – Turn any screen into a sign. The URL is the app▲728

  Turn a phone, tablet or TV into a sign. Type a message and it fills the screen: welcome signs, timers, Wi-Fi passwords and more. No app, no account, free.

  Life & fun · 15d ago · bigwords.page

• 
  Guitoro, a virtual guitar you strum with your keyboard▲573

  Play a free virtual guitar online with your keyboard or by touch. Slow songs down and see every chord, string and strum. Acoustic, classic, electric and bass.

  Life & fun · 9d ago · guitoro.com

• 
  See *almost* any carriers phone settings▲432

  Carrier settings from iPhone, Pixel and Galaxy firmware, decoded and compared: APNs, VoLTE, 5G and Wi-Fi Calling per carrier, and what each build changed.

  Life & fun · 13d ago · carrierexplode.com

• 
  The whole Solar System and every tracked satellite, live in the browser▲407

  Life & fun · 23d ago · space.bl2.net

• TL
  The load-bearing vocabulary of Claude▲710

  Life & fun · Aug 2026 · louisabraham.github.io

• 
  Hey Noah▲656

  A proactive AI executive assistant for founders

  AI · Aug 2026 · heynoah.io

• 
  Clipto MCP▲655

  Hey HN, We recently built Clipto. It’s a tool that lets you search over terabytes of video, audio, and images on your computer, without relying on the cloud. Motivation: we probably all had this similar experience, we know a moment exists in a video or audio, but finding it takes hours scrubbing the timeline. You can send all the media to process in the cloud, but it’s slow, expensive and raises privacy concerns. So we decided to build our own on-device media search engine. How it works (high level): 1. We ingest video, audio, image; normalize formats via ffmpeg; run content analysis to…

  Work · Aug 2026 · clipto.com

• 
  Simple algorithm and color space to generate diverse skin tones▲627

  Hello HN! I found that picking out plausible but diverse skin tones for my digital art and game development projects was kind of difficult, and I got curious about if there was a way to define a color space that made it easy. I've built a color picker and procedural generation algorithm based on the space as well as a bunch of other fun js features and demos throughout the page that use the equations. If you find it interesting, I have lots of explanations of how I built it and what properties the space has. The methodology might be a bit shaky, but hopefully the result is as helpful for…

  Life & fun · Aug 2026 · toneyalexander.github.io

• 
  AdAnt AI▲620

  Claude for viral, high-converting social ads

  AI · Aug 2026 · adant.ai

• 
  Astute▲606

  Automate your B2B brand going viral, with new media creators

  AI · Aug 2026 · company-app.joinastute.com