Cloaking

Cloaking is when a malicious site shows different content depending on who is visiting. Real targets see the phishing page or scam, while security crawlers, ad reviewers and abuse teams see an empty page, an error or an innocent-looking site. It is one of the main reasons a reported phishing site can look "clean" to the people asked to remove it.

How it works

Before deciding what to show, the site checks details about the visitor. Common filters include:

• IP address ranges of cloud providers, security vendors and search engines;
• country or mobile carrier, so only visitors from the targeted market see the page;
• user agent, so only phones or certain browsers are served the phishing content;
• one-time or token-based links that work once and then return an error;
• referrer checks, so only visitors arriving from the lure (an SMS, ad or email) get through.

Many phishing kits ship with these filters built in. In malvertising, cloaking is used to get past ad platform reviews.

Example

As an illustration, a fake parcel-delivery page on examplecargo-track[.]com only shows the payment form to mobile visitors with IP addresses from one country. A security analyst opening the link from a desktop in a data centre sees a blank page. A registrar checking the report sees a "404 Not Found" and closes the ticket, while people receiving the SMS still see the fake form.

How to spot it

• A link that works on a phone but shows nothing on a desktop.
• Different content when the same URL is opened from another country or network.
• Links that work once, then return an error.
• Abuse teams replying that the site "contains no malicious content" while victims keep reporting it.

What brands can do

Collect evidence the way victims see the page: use a mobile user agent and a network in the target country, and save screenshots, full URLs, timestamps and page source. Include those details in every report and explain the cloaking conditions, so the reviewer knows how to reproduce it. Reporting to Google Safe Browsing and other blocklists in parallel helps, because warnings can protect users even while a host is still reviewing. Phishvoid's analysts document cloaked sites this way before filing; contact us if your reports keep being closed as "not reproducible".

Read more: The Phishing Site Takedown Process, Step by Step