Google Ads Cloaking: Safe, Scalable Tactics That Work Now

Google Ads cloaking is harder than Facebook for one reason: Google owns the entire stack. Search, browser (Chrome), DNS (8.8.8.8), the ad network, the verifier infrastructure. They cross-reference signals across products in ways no other platform can.

But cloaking still works on Google in 2026. The trick is a tighter detection setup with platform-specific signals.

The Google IP ecosystem

Google operates from AS15169. Key ranges to filter:

• 66.249.64.0/19 — Googlebot, AdsBot
• 64.233.160.0/19 — Google services
• 72.14.192.0/18 — Google
• 74.125.0.0/16 — Google
• 108.177.96.0/19 — Google
• 142.250.0.0/15 — Google
• 172.217.0.0/16 — Google
• 216.58.192.0/19 — Google
• 35.190.0.0/16 to 35.208.0.0/16 — Google Cloud (reviewers often spin up GCP VMs)

Hardcoding all of these is essential. Overcloak ships them by default — no setup required.

AdsBot vs Googlebot vs review crawlers

Three different bots, three different jobs:

• Googlebot — search index crawler. UA: Googlebot/2.1. IP: 66.249.x.
• AdsBot-Google — landing page quality crawler. UA: AdsBot-Google. IP: same range as Googlebot.
• Manual reviewer — real Chrome instance, residential or Google Cloud IP, full JS, full DOM inspection.

AdsBot is the most aggressive. It loads your landing page from multiple IPs over the first 24 hours of campaign launch. If you serve the offer to AdsBot, your campaign gets disapproved within hours.

What kills Google campaigns

1. 1Showing the offer to AdsBot (instant disapproval)
2. 2Mismatched landing — Google compares the destination URL DOM against the headline. 'Buy Bitcoin Now' headline pointing to a wellness blog gets caught by their text-similarity classifier.
3. 3Trust score — your domain, age, SSL, registrar. Brand-new domains on Porkbun lasting a week get flagged.
4. 4User complaint signals — even one report from a Chrome user can re-trigger review.

The setup that works

1. 1Use a domain that's been live for 30+ days — warm it up with normal traffic first (some of our customers run 200 organic clicks before linking it to ads).
2. 2Create a flow with Google Ads as the platform.
3. 3Set allowedReferrers to: google.com, googleads.g.doubleclick.net, googleadservices.com.
4. 4blockDatacenter ON (catches GCP reviewers).
5. 5Generate a niche-matched AI compliance page with semantic similarity to your headline.
6. 6Test the cloaked URL with curl using a Googlebot UA — should serve compliance. Test with a real Chrome from a residential IP — should redirect to offer.

Enhanced Conversions + cloaking

Google's Enhanced Conversions API is the server-side replacement for cookies. It works with cloaking — fire the conversion server-side from your offer page or via Overcloak's postback URL. We send the click_id forward so Google attributes correctly.