Why you see the scam and the ad reviewer doesn’t: what cloaking is
In this article
In short: many scam ads pass review because the page does not show the same thing to everyone. A program decides who you are in tenths of a second. If you look like a victim, you see the fake news story with the celebrity. If you look like a reviewer, an antivirus or a researcher, you see a harmless blog or an error. It is called cloaking, and it explains why you sometimes report a website and whoever checks it sees nothing.
How it decides who you are
When you click the ad, your visit passes through an intermediate system that looks at several things: which country you are in, what device and browser you use, where you came from and whether your connection looks like a security company’s. With that, it sends you to one place or another.
No exotic technology is needed. What is usually used is commercial ad measurement software, the same type of tool any agency uses to route traffic. In March 2026, Confiant and Infoblox published four months of research into the abuse of one of these programs: 15,500 malicious domains, about 9,000 of them registered on purpose, with clean pages for anyone who looked like a reviewer. The dominant category was investment scams.
Documented tricks
- A preview that is not the real thing. Bitdefender analysed 310 campaigns on Meta in February and March 2026, with more than 26,000 ad appearances. In Italy, the ads showed the websites of real restaurants in Florence as a preview. The automated system saw a restaurant, and the victim ended up somewhere else.
- Measuring whether you read. Whalebone studied more than 400 fake news domains in July 2026. The page recorded how far you scrolled, how much you read, whether you switched tabs and at what point you left.
- Changing domains non-stop. When one domain falls, another takes over. We saw it live: less than 14 hours between a domain’s suspension and its replacement.
What we see
Our data fits with this, although we cannot see the inner workings of those systems.
- Throwaway addresses. The 398 ad links contain 294 different domains. Some look machine-generated: meaningless strings of letters and numbers. Fewer than half end in .com. Next come .info, .top, .click and .pro.
- Links that respond “not found”. Many links from promotional videos and blogs return an error if you open them directly, as we explain here. We cannot be sure it is cloaking, because it could also be a dead link. But it is what we would see if it were, and as a rule we do not try to trick those systems into showing us more.
Why it matters to you
1. A website that “no longer exists” has not necessarily closed. If a relative shows you a link and you get an error or a normal page, the system may have ruled you out: a different country, a different device, not coming from the ad.
2. Save evidence at the time. If you are going to report it, take screenshots of what you see, with the address visible. The police or the platform may not see the same thing later. Also note the date and how you got there.
3. Report the ad, not just the website. Use the social network’s report option from the ad itself. That way the platform can identify it even if the page is cloaked.
4. An ad being live does not mean it has been checked. The review may have seen something very different.
5. Passing a security scan proves nothing. A website checker may say the page is clean because it was shown the clean version.
If you have already given your details, follow the victim guide.
Limitations
The figures from Confiant, Infoblox, Bitdefender and Whalebone are theirs, and relate to their samples. We have not verified from the inside how each of the systems in our data decides.