Phishing detection has always been a race to identify malicious websites before attackers can reach their intended victims. But that race has become significantly more difficult. AI enables attackers to generate convincing phishing campaigns at unprecedented speed and scale. At the same time, increasingly sophisticated cloaking technologies, such as geo-fencing, make those campaigns far harder to detect.
By selectively serving different content based on a visitor's location, device, or other characteristics, attackers can hide malicious pages from security researchers, automated scanners, and threat intelligence platforms while continuing to expose them to intended victims. An attack may be actively harvesting credentials in London while a security operations center in New York sees nothing more than a 404 error or a harmless redirect to Google.
This ability to selectively conceal malicious content has created a significant blind spot for organizations that rely on conventional web crawling and threat detection methods.
What is cloaking?
Cloaking is a set of techniques designed to prevent security teams from seeing the same content that victims see.
Rather than exposing a phishing page to every visitor, attackers selectively reveal content based on factors such as location, ISP, browser characteristics, referral source, or device behavior. If a visitor appears to be a security researcher, automated scanner, or threat intelligence platform, the site may return a harmless page, a redirect, or no content at all.
The objective is straightforward: keep the phishing campaign visible to intended victims while hiding it from the tools designed to detect and disrupt it.
The rise of "cloaking-as-a-service" (CaaS)
Attackers are increasingly outsourcing their evasion strategies. Rather than developing custom scripts, threat actors can now subscribe to dedicated AI-powered cloaking platforms that manage detection avoidance for them. Services such as FingerprintJS provide sophisticated filtering capabilities that determine whether a visitor should see a legitimate webpage or the underlying phishing experience.
This evolution has effectively created a new category of criminal tooling: Cloaking-as-a-Service (CaaS). These platforms continuously evaluate visitors against dozens of signals before deciding whether to reveal malicious content.
That means security crawlers are no longer competing against static webpages. They're competing against dynamic decision engines designed specifically to evade detection.
Traditional URL discovery alone cannot solve this problem. Modern Digital Risk Protection (DRP) platforms must be able to replicate the conditions of real victims, uncovering phishing infrastructure that remains invisible to conventional scanners.
How criminals "filter" the world (The technical barrier)
Modern phishing campaigns apply multiple layers of filtering before displaying malicious content:
Residential, ISP, and device targeting: Attackers routinely block traffic originating from cloud providers such as AWS, Azure, and Google Cloud. They also evaluate characteristics such as device type, operating system, browser, and other environmental signals to determine whether a visitor matches their intended target. If a DRP platform performs scans from a data center IP address or an unexpected device profile, attackers immediately recognize it as suspicious and withhold the phishing content.
The result is a false sense of security. Security teams may receive a clean result while real users continue to be targeted elsewhere.
JavaScript fingerprinting: Attackers also inspect browser characteristics to determine whether visitors are human. Phishing pages may analyze:
Screen resolution
Device memory
Rendering capabilities
CPU performance
Browser automation signatures
Many phishing kits now include proof-of-work challenges that require visitors to solve lightweight computational puzzles before content loads. Headless browsers that cannot complete these checks are immediately rejected.
Attackers increasingly look beyond a single request. Many phishing kits track whether a visitor presents a consistent identity across multiple interactions, including the same device characteristics, browser fingerprint, and network attributes. If those signals suddenly change, the visitor is more likely to be treated as a security researcher or automated scanner than a legitimate target.
Referrer-only loading: Some phishing campaigns only activate when users arrive through a specific source. For example, a phishing page may remain dormant unless visitors arrive through an SMS message containing a specific referral header.
Anyone attempting to access the URL directly will encounter a benign page instead of the phishing experience.
Time-of-day cloaking: Attackers are also becoming increasingly selective about when they expose malicious content.
A phishing campaign targeting a financial institution may only become active during local business hours, allowing it to avoid overnight security sweeps and reducing the likelihood of discovery.
TLS fingerprinting: Attackers increasingly analyze the characteristics of a visitor's TLS handshake before serving any content. Every browser, operating system, and HTTP client establishes secure connections in slightly different ways, creating a fingerprint that can reveal whether the visitor is using Chrome, a mobile browser, an automated crawler, or a custom security tool.
If the TLS fingerprint doesn't match that of a legitimate user, the phishing kit may never deliver the malicious page. Instead, the visitor may receive a benign website, a redirect, or an error message, allowing the campaign to remain hidden while continuing to target real victims.
Collectively, these tactics create what many security teams experience as an active threat that appears nonexistent during investigation.
“You can have a bank that has a French headquarters, but they might have a load of customers in some African countries, for example. And, that's what actually matters. Because the whole premise behind all of this is the fraudster, the bad guy, they only want their attacks to be visible to their victims,” said Charlie Hothersall-Thomas, Director of Engineering at Netcraft.
Technical logic: Detecting evasion by bypassing geo-fencing and cloaking
Overcoming modern cloaking requires more than rotating IP addresses. It requires recreating the conditions attackers expect from legitimate victims.
1. Decentralized residential egress to defeat geo-fencing
Geo-fencing is often the first layer attackers deploy. Traditional scanners fail because they originate from recognizable data centers (AWS, Azure), which are routinely blocked by attackers using geo-fencing rules.
Rather than relying on cloud infrastructure, leading DRP vendors replicate contextual residency instead of just rotating IP addresses. For example, Netcraft’s global proxy network routes traffic through a global network of more than 250 residential nodes, replicating the same internet service providers and regions used by actual victims.
For example, if attackers are targeting a Brazilian bank, our systems automatically retrieve content through a residential ISP in São Paulo. Instead of encountering a 404 page, we uncover the attacker's intended phishing experience.
This approach transforms hidden infrastructure into actionable evidence.
Geo-fencing, however, is only one layer of evasion. More sophisticated campaigns also evaluate device fingerprints, user behavior, and referral data.
2. Headless browser "stealth mode" and fingerprint randomization
Attackers increasingly use JavaScript Fingerprinting to detect automated bots. DRP providers like Netcraft counter these techniques by operating full-render headless browsers in stealth mode, presenting characteristics that resemble standard consumer devices. Our systems can:
Solve proof-of-work challenges. Many phishing kits now require browsers to complete CPU puzzles before loading content. Netcraft’s engines successfully complete these tasks to demonstrate legitimate behavior.
Simulate realistic user interactions. Netcraft recreates human activity patterns, including erratic mouse movement, scrolling behavior, and touch event signals. Netcraft can also automatically solve challenges that require human interaction, like CAPTCHAs.
Bypass anti-virtual machine checks. Our browser fingerprints mirror the characteristics of common consumer laptops and mobile devices rather than virtualized environments.
Rather than simply visiting a webpage, Netcraft effectively participates in the interaction as a legitimate user would. Companies like Netcraft also use threat intelligence bots to track malicious internet traffic, scan for network vulnerabilities, and respond to automated attacks in real time.
3. OCR and computer vision at the edge
Attackers have also evolved beyond text-based phishing pages. Many now embed text inside images or render text directly to a canvas to evade keyword detection systems. Traditional scanners may successfully retrieve the page while still failing to identify brand impersonation because the text is cloaked within those images.
Netcraft addresses this challenge by combining Optical Character Recognition (OCR) with computer vision technologies. Our systems analyze webpages visually, capturing screenshots and extracting text regardless of whether it exists in HTML. This allows us to identify:
Brand impersonation
Fraudulent login pages
Fake customer support portals
Credential harvesting forms
The resulting evidence is automatically packaged into Verified Attack Indicators (VAI), creating a documented chain of custody that supports rapid enforcement actions with registrars and hosting providers.
Closing the "victimization window"
Perhaps the biggest shift in digital risk protection is timing. Organizations can no longer afford to wait until a phishing page is fully operational before responding.
By using residential proxies and adversary emulation techniques, Netcraft’s Preemptive Domain Disruption can identify dormant infrastructure and pre-live phishing environments before attackers launch them at scale.
This enables companies to “jump left of live” to stop attacks before they can spin up and shorten what the victimization window: the amount of time an attack remains accessible to potential victims. Instead of reacting after customers are targeted, organizations can intervene earlier in the attack lifecycle.
Why this matters for 2026 strategy
Attackers are investing heavily in concealment. As a result, visibility alone is rapidly becoming a commodity. Discovering a suspicious domain is only one piece of the puzzle. Effective phishing detection now requires the ability to consistently uncover malicious content hidden behind layers of geo-fencing, browser fingerprinting, and cloaking. Strong Digital Risk Protection (DRP) providers must be able to see what attackers are actively trying to hide.
Organizations evaluating DRP providers should ask a simple question: Can your platform prove it is seeing what victims actually see?
If the answer is no, there is a strong possibility that a meaningful portion of your external attack surface remains hidden from view. Because in 2026, the most dangerous phishing attacks are often the ones security teams never see at all.
