Guide · Cloaking
What is cloaking in phishing?
By the SENTLOCK team · Updated
Short answer
Cloaking is when a phishing site shows different content depending on who is visiting. Automated security scanners and researchers get a harmless decoy page, while real victims get the page that steals their credentials. Because most scanners only ever see the decoy, they mark the site as safe and the attack keeps running.
How do phishing kits decide who sees what?
- Network
- Visits from datacenter and security-vendor address ranges get the decoy.
- Browser fingerprint
- Headless browsers, known crawlers and unusual browser signatures are turned away.
- Location and language
- Only visitors from the targeted country, or with the expected language settings, see the attack.
- Referrer and one-time links
- The real page loads only from the link in the phishing message, sometimes only once.
- Timing and interaction
- The malicious content appears only after a delay, a click or a mouse movement.
Why do ordinary scanners miss cloaked phishing?
Most URL scanners fetch a page once, from a datacenter, often with an automated browser. Those are exactly the visitors cloaking is designed to turn away. The scanner records a blank page, an error or an innocent site, and the verdict comes back clean.
How does SENTLOCK see past cloaking?
SENTLOCK's cloaking-bypass layer loads the page the way a real customer would and inspects what actually comes back. The verdict is then based on the page victims are shown, not on the decoy. It is one of eight layers, so it is corroborated before anything is reported. See all eight layers.
What does cloaking mean for your brand?
If your monitoring relies on tools that only ever see decoys, a live phishing page on a look-alike domain can stay online while being reported as safe. Protecting a brand means looking at the internet the way your customers do.
See which look-alikes target your brand
Run the free instant check on your domain, or request early access for continuous monitoring.
