Cloaking

The injected code inspects the incoming request and branches. Cheap implementations match the user agent string against a list containing Googlebot and Bingbot. More careful ones check the client IP against published crawler ranges, or verify reverse DNS, and cache the verdict so repeat requests stay consistent. Some add a third branch for visitors arriving from search results, which is where redirects are usually attached.

User-agent cloaking

Branching on the User-Agent header, the easiest form to detect.

IP cloaking

Branching on the client IP address, so a spoofed user agent from an ordinary network still sees clean content.

Referrer cloaking

Branching on the Referer header to target only visitors arriving from search engines.

1. STEP 01

   Capture a baseline

   Fetch the page with a normal desktop browser user agent and store the HTML.

2. STEP 02

   Fetch as a crawler

   Repeat with a Googlebot user agent. Any structural difference in body content is a cloaking signal.

3. STEP 03

   Fetch with a search referrer

   Repeat with a search engine referrer and no cookies to surface referrer-gated payloads.

4. STEP 04

   Compare against the rendered page

   Use Search Console's URL inspection to see what Google actually received, and compare it with your baseline.

Because the owner's own testing returns clean pages, cloaked compromises are usually reported by a third party: a customer, a search warning, or a partner. That delay gives the attacker time to index thousands of pages and establish persistence, which is why cloaked spam takes longer to clear from search than the technical cleanup itself takes.