Scammers today are high-tech equipped. They have an IT team as good as any software company. These IT professionals might not operate scam activities themselves, but they provide dangerous tools and systems to scammers. It is unclear whether those highly educated individuals chose to work for the scam industry, are themselves victims of another scam recruitment, or are backed by some cybercriminal gangs, which, in turn, are supported by a few governments – which you can guess. However, an uncomfortable fact is that they have black hats on their side!
Fake websites, also known as impersonated or rogue websites, are designed to look as polished as official ones. Scam websites copy not only logos but also the professional feel of legitimate sites. However, their weakness always lies in their domain names. Security researchers can often detect these websites easily using a web crawler, but it is not as simple anymore. Today, these websites can employ camouflage techniques to hide themselves from security researchers.
This post will list some techniques commonly used by scammers to hide their content from researchers and provide a solution to this problem.
1. Cookie-Based Cloaking
Cookie-based cloaking, or Cookie-Based Redirecting, Cookie-Gated Content is a web technique where a website changes its behavior depending on cookies stored in the visitor’s browser. A cookie is a small piece of data that websites save in the browser to remember information such as login sessions, referral sources, advertising campaigns, previous visits, and tracking identifiers. A website can use this information to determine what content to show to a visitor. Scam websites use this technique to:
- Show trivial content, such as a skateboard product homepage or a small HR company landing page, to visitors who access it directly by entering their domain name.
- But if a visitor comes via clicking an ad on social networks, it shows scam content such as impersonating famous services or companies to trick visitors into downloading or paying in advance.
By this trick, a web crawler will not see scam content, so it may fail to flag it as a scam.
2. Geo-Targeting
Similarly to cookie-based cloaking, geo-targeting scams activate only for visitors from certain countries or cities. Scam websites can use the IP addresses of visitors to determine what content to display instead of relying on cookie data. Scam websites can use this technique to hide themselves from cybersecurity researchers who are hunting for them. Many cybersecurity companies scan websites from US cloud providers, data center IP ranges, or known research networks. Scam sites can detect these IP ranges and automatically hide scam content from those locations.
Another usage of geo-targeting is to localize content by using visitors’ languages. Scam content feels more convincing if it uses local languages, local currencies, local phone numbers, local branding, and region-specific holidays or events. Victims are more likely to trust the page if they see familiar information and symbols. With a domain name slightly different from legitimate ones, it can actually fool a lot of people around the world.
3. Device-Based Targeting
Device-based targeting is a technique where a website changes its behavior depending on the visitor’s device, operating system, browser, or hardware characteristics. The same URL may show content completely differently among Android phones, iOS phones, Windows PCs, or macOS. Scammers use this technique to target specific victims to deliver platform-specific malware. For example, if scammers want to deliver Windows malware, they can make their scam website display scamming messages only if the user is using Windows. This is possible because browsers (Chrome, Firefox, etc.) attach OS info to every HTTP request. When a researcher is using macOS or a phone, they won’t see the scam messages. This is one of the most common camouflage methods in modern phishing and malvertising campaigns.
4. Time-Based Activation
Time-based activation is a camouflage technique in which a scam website becomes malicious only during specific periods.
This technique is often used with ad campaigns. Digital ad platforms such as Facebook or Google always review a website’s content before placing ads, and they strictly ban scam and impersonated content. However, scammers can now bypass this Ad Review System. They can put normal content on a website during the review period so that their website can be accepted. But a scammer’s website can be programmed in a way that it only shows scam content at specific times, for example, only from 8 PM to 10 PM. Because Ad Review Systems have no access to a website’s source code, they have no clue if a website uses this technique. As a result, scammers can guess when their victims are usually online and configure their scam website to show scam content at that time.
This Time-based activation method also helps them avoid being detected by scanners, limits their exposure, and increases their success rate.
5. URL Shorteners Abuse
URL shorteners such as Bitly or TinyURL are tools used to shorten URLs to make them look nice when sharing and appear less dangerous. Scammers can exploit these tools to make their links less suspicious. When users click on a shortened link—let’s say shortened by TinyURL—browsers (Chrome, Firefox) make a request to TinyURL’s server, which then redirects the user to the scammer’s actual link. Scammers exploit this function to hide their real domain names and borrow credibility from well-known companies like Bitly and TinyURL. This method is often used by scammers when they choose to send links via SMS. Because the URL looks short and originates from reputable services like Bitly or TinyURL, victims may let their guard down and click the shortened link.
6. One-Time URLs
Another effective camouflage method used by scammers is the use of “One-Time URLs.” One-Time URLs are links that display scam content only once; afterward, the content disappears or changes completely. Technically, this behavior is not difficult to implement—any experienced web developer can build such functionality, and organized scam operations often have dedicated IT teams capable of deploying it at scale.
In a typical scenario, when a targeted victim clicks a malicious link sent through SMS, email, social media, or advertisements, the page displays phishing content, fake login forms, investment scams, or malware download prompts. However, if the victim later revisits the same link—or sends it to a friend, bank employee, or cybersecurity researcher for verification—the page may suddenly become unavailable, return a “404 Not Found” error, redirect to a harmless website, or display completely normal content unrelated to the scam.
7. JavaScript-Only Payloads
Many web scanners depend on HTML content when analyzing websites. To hide scamming intentions, modern scam websites increasingly avoid placing malicious text, phishing forms, or scam indicators directly inside the initial HTML response. Instead, they use JavaScript to dynamically generate content only after the page loads, often based on factors such as device type, browser behavior, cookies, location, or user interaction.
In many cases, the HTML page initially appears almost empty or completely harmless to automated scanners. The actual phishing interface, fake login form, or malicious redirect is later constructed in the browser using obfuscated JavaScript, remote payload downloads, or delayed execution techniques. Some scam pages even activate only for real mobile users while showing benign content to security researchers or automated bots.
This technique, commonly referred to as a JavaScript-only payload or client-side payload delivery, makes detection significantly more difficult because traditional scanners may never execute the necessary scripts long enough to observe any malicious behavior.
8. Image Only Websites
Similar to JavaScript-only payloads, to bypass traditional scanners, some scam websites avoid placing meaningful textual content directly inside the HTML page and instead render their entire interface as images. Banking forms, warning messages, promotional banners, fake customer support chats, and even login screens may exist only as embedded images, while the underlying HTML remains nearly empty or harmless-looking.
Because many security systems primarily analyze HTML structure, DOM text, metadata, and visible keywords, image-only websites can significantly reduce the effectiveness of conventional phishing detection methods. Without advanced image analysis or OCR (Optical Character Recognition), automated scanners may fail to recognize brand impersonation, phishing instructions, or scam-related language contained in the images themselves.
Some campaigns further combine this technique with JavaScript rendering, geo-targeting, or device-based targeting to dynamically serve different image payloads depending on the victims’ environments, making automated analysis even more difficult.
9. Compromised Legitimate Websites
This case rarely happens, but it does occur—even on legitimate government websites. In some countries, cybersecurity investment remains limited, outdated, or poorly maintained. As a result, official government websites may eventually be hacked through vulnerable CMS platforms, weak administrator passwords, outdated plugins, exposed servers, or neglected infrastructure.
Once attackers gain access, they may place scam advertisements, phishing links, fake investment promotions, gambling content, malware downloads, or redirects to rogue websites directly on the homepage or within trusted government subpages. In other cases, attackers quietly inject hidden links or malicious JavaScript that redirects only selected visitors to scam pages while the website otherwise appears normal.
Because the malicious content is hosted on an official government domain, victims are far more likely to trust it. This case demonstrates an important reality: a trusted domain does not always guarantee trusted content. Even legitimate websites can be hacked and injected with scam campaigns if their systems are not properly secured and monitored.
10. SEO Poisoning
People today often trust Google search results more than their own judgment, and scammers actively exploit this behavior through a technique commonly known as SEO poisoning. Instead of sending suspicious links directly, attackers attempt to manipulate search engine rankings so that their scam pages appear near the top of search results for popular or urgent keywords.
Scammers today have their own content creator teams. These teams are responsible for producing convincing materials designed to build trust, attract victims, and make scam campaigns appear professional and legitimate. They also have an SEO team, which is responsible for optimizing the SEO ranking of their websites. As a result, when a user searches for a solution on Google Search, they may land on a scammer’s website. These websites usually provide content that is 90% true and harmless, but the remaining 10% is faked, mostly to instruct users—who already trust it due to that 90%—to download malware or to make advanced payments.
11. Advertisement Abuse
When SEO takes time to achieve top ranking or seems impossible, scammers still have another choice: they run ad campaigns. They pay for Google Ads to display their website at the top. These ads usually have the word “Sponsored” under their name to distinguish them from other organic SEO rankings. However, users often overlook this and typically trust the first website they see.
Scammers usually exploit this behavior by creating ads that imitate banks, airlines, government services, cryptocurrency platforms, technical support companies, and package delivery services. The advertisement itself may appear completely legitimate, using official logos, professional descriptions, and similar domain names. Some malicious campaigns even use typo-squatting domains that look visually similar to trusted brands.
Because advertising systems operate at a massive scale, attackers sometimes manage to run malicious ads temporarily before automated moderation systems detect and remove them. During that window, thousands of users may have already clicked on the scam advertisement.
12. Multi-Step Redirect Chains
This is not a new technique but rather a combination of many of the camouflage methods described above. In a Multi-Step Redirect Chain attack, the victim does not directly land on the final scam page; instead, they are silently redirected through multiple intermediate websites, tracking systems, shortened URLs, advertising networks, cloaking pages, or compromised domains before eventually reaching the malicious destination. Each step serves a specific purpose:
- dynamically changing payloads
- hiding the final destination
- bypassing blacklist systems
- filtering unwanted visitors
- tracking victims
- evading automated scanners
For example, a security scanner may inspect only the first redirect and conclude that the link is harmless, while the actual phishing content appears only after several additional redirects triggered under very specific conditions. Some redirect chains additionally check:
- IP reputation
- country
- browser fingerprint
- mobile vs desktop
- cookies
- referral source
- whether the visitor appears to be a scanner
If the visitor is suspected to be: a researcher, a security crawler, a virtual machine or a headless browser, the chain may terminate early and show harmless content instead of the real scam page.
Modern scam operations often treat redirect chains almost like traffic-routing infrastructure. Different victims may be sent to completely different scam pages depending on language, location, device type, advertising campaign, and time of day. This technique is particularly effective because no single website in the chain necessarily appears obviously malicious on its own. Some intermediate pages may even belong to legitimate ad networks, hacked government websites, trusted cloud platforms, URL shorteners, or compromised websites.
As a result, automated detection becomes significantly harder because scanners must successfully follow every redirect step, emulate realistic user behavior, and trigger the correct environmental conditions before the final malicious payload is revealed.
So, how can we detect these camouflaged scam websites?
How to Detect Camouflaged Scam Websites
Based on known camouflage techniques, detection algorithms can no longer rely solely on static content analysis. Modern scam websites are increasingly capable of dynamically changing their behavior depending on the visitor’s device, location, cookies, referral source, browsing history, or even the current time. A webpage that appears completely harmless to an automated scanner may simultaneously display phishing forms, malware downloads, or fake investment dashboards to real victims under carefully selected conditions.
Because of this, modern detection systems must evolve from simple “page inspection” to behavioral and contextual analysis systems. Instead of analyzing only the final rendered HTML, security solutions increasingly need to observe:
- redirect chains
- device-specific responses
- geo-dependent behavior
- JavaScript execution
- timing anomalies
- browser fingerprint checks
For example, if a website behaves differently between mobile and desktop devices, changes content after several visits, or only activates after arriving from advertisements, these behavioral inconsistencies may become stronger indicators than the visible content alone.
This is one reason why modern phishing detection has become significantly more difficult than traditional spam filtering: scam infrastructure is no longer static; it is adaptive, selective, and increasingly designed to study the visitor before revealing its true intent.
There is an active project adapting this approach to combat the scamming plague: SafePhone. SafePhone for Android is now available on the PlayStore, and the homepage is at: https://safephone.io.vn/.
Build – Secure – Evolve with the-tech-lead.com