# Cloaking

Cloaking is showing different content to different visitors, so a phishing site serves the real lure to targets and a harmless page to scanners, moderators and researchers.

## How it works

The server or a script checks the IP address, user agent, referrer, language, time zone or JavaScript behaviour. Visitors that look like bots, security vendors or the wrong country receive a white page or a redirect.

Cloaking explains why scanners disagree about the same URL and why ads for scam sites pass review.

## Example from the PhishDestroy database

- [tronact.net](https://phishdestroy.io/domain/tronact.net/): Domain with a recorded cloaking observation, first detected 2026-07-09.
- [naebwin.com](https://phishdestroy.io/domain/naebwin.com/): Domain with a recorded cloaking observation, first detected 2026-07-09.
- [bomawin.com](https://phishdestroy.io/domain/bomawin.com/): Domain with a recorded cloaking observation, first detected 2026-07-09.

## How to protect yourself

- Compare what a browser and a crawler receive; a large difference is itself evidence.
- Report the URL with captures from a real browser, not only a scanner verdict.

## Related tools

- [Reputation Links](https://phishdestroy.io/developer-tools/reputation-links)
- [Evidence Record](https://phishdestroy.io/developer-tools/evidence-record)

## Related terms

- [Traffic distribution system (TDS)](https://phishdestroy.io/glossary/tds/)
- [Fake CAPTCHA](https://phishdestroy.io/glossary/fake-captcha/)

## Further reading

- [Cloaking & White Pages Explained](https://phishdestroy.io/cloaking-whitepages-explained)
- [Why Phishing Scanners Disagree: A Field Guide](https://phishdestroy.io/why-phishing-scanners-disagree)
- [Keitaro TDS Exposed: Traffic Distribution](https://phishdestroy.io/keitaro-tds-exposed)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/cloaking/