Cloaking
Cloaking is showing different content to different visitors, so a phishing site serves the real lure to targets and a harmless page to scanners, moderators and researchers.
How it works
The server or a script checks the IP address, user agent, referrer, language, time zone or JavaScript behaviour. Visitors that look like bots, security vendors or the wrong country receive a white page or a redirect.
Cloaking explains why scanners disagree about the same URL and why ads for scam sites pass review.
Example from the PhishDestroy database
- tronact.net: Domain with a recorded cloaking observation, first detected 2026-07-09.
- naebwin.com: Domain with a recorded cloaking observation, first detected 2026-07-09.
- bomawin.com: Domain with a recorded cloaking observation, first detected 2026-07-09.
How to protect yourself
- Compare what a browser and a crawler receive; a large difference is itself evidence.
- Report the URL with captures from a real browser, not only a scanner verdict.