Malte ZanderContents
Hidden fake pages only show their content under certain conditions: with the right parameter in the link, only on a smartphone, only from certain countries, only after a click or only to visitors who behave like real people. Scanners and reviewers then see an empty or harmless page. The most reliable way to find such fakes is through the people who received the real link, and you report them with the full link and a description of how the fake appears.
- In an analysis of 112,005 phishing websites, 31.3 percent used tricks in the browser to hide their content from automated checks (Zhang et al., IEEE S&P 2021).
- The share of such sites grew during the study from 23.32 percent in 2018 to 33.70 percent in 2019 (Zhang et al., IEEE S&P 2021).
- In tests with 150 purpose-built phishing sites, all three categories of tricks studied evaded browser-based phishing detection (Zhang et al., IEEE S&P 2021).
- In a large study, Google Safe Browsing detected only 18.41 percent of phishing URLs on its own (Lee et al., WWW 2025).
What is a hidden fake page?
A fake that decides whom it shows itself to. Experts call it cloaking. On every visit, the page checks whether the visitor is a potential victim or a scanner, a reviewer or a security researcher. Victims see the fake form; everyone else sees an empty page, an error message or a harmless redirect, often to your real website. For operators it pays off, because detection systems and abuse teams find nothing to block.
Which tricks are used?
| Trick | What is checked | Effect |
|---|---|---|
| Parameters in the link | An identifier, a name or an email address in the URL | Without the full link, the page stays empty |
| One-time links | Whether the link has been used before | Nothing appears on the second visit |
| Origin | Country or network of the IP address | Only visitors from the target region see the fake |
| Device and browser | Smartphone or desktop, browser type | Often mobile visitors only |
| Referrer | Where the visitor comes from | Only visitors from the phishing email or ad |
| User interaction | A click, a button, a verification step | Automated scanners get no further |
| Browser characteristics | Typical properties of real browsers | Automated browsers are recognised |
| Behaviour | Mouse movements, waiting times | Bots see something different from people |
The last three tricks run in the browser. The CrawlPhish study grouped them into three categories: user interaction, fingerprinting and bot behaviour. All three evaded browser-based phishing detection in tests (Zhang et al., IEEE S&P 2021).
Why are links with parameters especially tricky?
Because they need no technical sophistication and still hide almost everything. A typical example is fake verification pages for certificates: the QR code on a forged certificate leads to an address with an identifier, such as your-brand-check.com/verify?id=48213. With that identifier, the page shows a "valid" certificate with a name and qualification. Without it, it shows nothing or a neutral home page. A scanner that only checks domains never sees the fake. It only becomes visible to the HR team or authority that scans the QR code.
The same applies to phishing links that contain the victim's email address so the form appears prefilled. Only the recipients know the full address.
How do you find hidden pages anyway?
Through the people who have the link:
Tips from outside: customers, employees, partners and verifiers, such as HR teams, receive the full link. A fixed reporting point on your website, such as a report widget, turns them into your best detection source.
Check the full link: open the page with exactly the link that was reported, in isolation and without entering anything.
Vary device and origin: check on mobile and desktop and, where possible, from the target region.
Watch domains anyway: hidden fakes need domains and certificates too, and those appear in registration data and transparency logs.
How do you document a hidden page?
Together with the conditions under which it appears. Record the full link, device, browser, location and time, plus screenshots with and without the parameters so the difference is visible. Archive the page with the full link. If the link contains victims' data, such as an email address, treat it as confidential and keep it out of public archives. More in Screenshots as evidence and Archiving fake sites.
How do you report a hidden page?
So that the reviewer can see the fake for themselves. State explicitly that the page only shows its content under certain conditions, give the full link and attach the screenshots. Ask the host to check the files on the server: the host sees the phishing kit regardless of what the page shows visitors. A registrar can suspend a lookalike domain registered for the purpose, even if the home page looks harmless. The mistakes that make such reports fail are described in Why takedowns fail.
How does AI Fraud Protect help?
AI Fraud Protect combines two sources: the web scanner, which finds lookalike domains, cloned pages and fake verification pages, and the report widget, through which customers, employees and verifiers report suspicious links with all their parameters. That brings fakes to light that hide from scanners. Every case gets an evidence package, and a person reviews and sends every report.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
Why doesn't our scanner see the page when customers report it?
Probably because it only shows its content with the full link, only on mobile or only from certain countries. Check with exactly the link the customer reported.
May I get around the cloaking to see the page?
You may open the link victims received. But don't enter any data and don't interfere with the page or the server.
Do hosts recognise hidden phishing pages?
Hosts can check the files on their servers. That's why it pays to point out the cloaking explicitly in your report.
Is an empty page on a lookalike domain harmless?
Not necessarily. It can be a hidden fake that only appears with the right link. Watch such domains and collect tips.
Sources
Zhang et al.: CrawlPhish, Large-scale Analysis of Client-side Cloaking Techniques in Phishing, IEEE Symposium on Security and Privacy 2021
Lee, Lim, Kim, Kwon, Kim: 7 Days Later, Analyzing Phishing-Site Lifespan After Detected, ACM Web Conference 2025