RosyGuard cloaker: WebAssembly fingerprinting gate on Canadian bank and credit-union look-alikes

Look-alike domains of Canadian business-banking portals and credit unions (CIBC Cash Management Online and Digital Business, RBC PayEdge, ScotiaConnect, and several credit unions' member sign-ins), mostly .at, .com and .gr.com names with one wildcard certificate per root. The server decides at the first request whether a visitor is wanted. A visitor it filters out, such as a scanner or a takedown crawler, is sent to an interstitial that calls itself the "RosyGuard corpus interstitial for FILTERED traffic". It loads /_af/sensor.wasm and two inline WebAssembly probes (relaxed-SIMD rounding quirks as a CPU and engine fingerprint, cache, store-forward and TLB timing to tell a virtual machine from real hardware, and the largest growable memory), signs the result, posts it to /.well-known/collect and /.well-known/collect2, and then redirects to the impersonated brand's real YouTube channel. Filtered visitors never see the lure, so a scan of a live member of this cluster usually ends on a YouTube consent page.