What is ad cloaking?
Ad cloaking is showing one page to ad reviewers, verification tools and data-center IPs, and a different page to the people an ad targets. A filter at the landing URL or in the redirect chain sorts each visitor; reviewers get a compliant "white page" while targets get the real offer, a scam or a forced redirect.
Updated
How cloaking works
The advertiser submits an ad whose destination passes review. Behind that URL sits a cloaker: a script or a paid traffic-filter service that inspects each visit and decides which page to return. The compliant page, often called the white page or safe page, is what the ad network's reviewers and crawlers see. The target page, the money page, goes only to visitors who match the advertiser's profile.
Google researchers' 2016 study Cloak of Visibility took apart commercial cloaking software and grouped its checks into network, browser and contextual fingerprinting. The groups still describe the field:
- Network. The visitor's IP range, ASN and reverse DNS. Ad network and verification ranges, data centers, VPNs and offices get the white page.
- Browser. User agent, JavaScript support, headless-browser markers, screen size, language and a time zone that should match the IP's country.
- Context. Whether the visit carries the click parameters the ad network adds, the referrer, cookies from an earlier visit, the time of day and whether this IP has been seen before. Many cloakers show the money page once per IP.
Cloaking or localization?
Sites legitimately serve different pages by country, language and device. The line Google and Meta draw in their ad policies is about who is shown what: giving ad review systems different content from what users get is cloaking, and both list it under circumventing systems.
The test is whether a reviewer in the same place, on the same device, would get the same page as a customer. A German visitor getting a German page priced in euros is localization. A data-center visitor in Germany getting a recipe blog while German households get a miracle diet is cloaking.
How to test for cloaking
- Find the ad and its destination without clicking it: in Google's Ads Transparency Center or Meta's Ad Library, or by reading the link from the publisher page's source. Keep the URL exactly as the ad links to it, tracking parameters included.
- Load it from a datacenter IP and from a residential IP in the targeted city, each in a clean browser profile with the device type the campaign targets.
- Record for each load every redirect hop with its status code, the final URL, a screenshot and a hash of the returned HTML.
- Repeat the residential load from a second, fresh exit, and again later in the day. A cloaker that shows the money page once per IP shows the white page to a repeat visitor.
- Call it cloaking when two consistent residential results differ from the datacenter result. One difference is a lead to repeat, not proof.
Common mistakes
- Testing from the office or a VPN. Both sit on cloakers' white-page lists.
- Reusing one residential IP. The second visit from it can get the white page, which reads as "no cloaking".
- Checking with JavaScript off or a plain HTTP client. Many cloakers run a script check first and treat a visitor that cannot run it as a bot.
- Desktop checks for a mobile campaign. Device type is one of the first filters.
- Clicking the ad. It spends the advertiser's budget and records an invalid click, and loading the destination URL shows the same page.
Cloaking checks on TrueProxies
Residential IPv4 gives the consumer side of the comparison: city targeting on Residential IPv4 Standard, Premium, Unlimited Bandwidth and Unlimited Pro (major cities), and ASN targeting on Unlimited Bandwidth, Standard and Premium for campaigns bought by ISP. On a rotating session each new connection asks for a new exit, which gives every repeat the fresh IP it needs. The ad verification checks list the fields to capture, and the evidence kit has blank templates for them.
Questions about ad cloaking
Is ad cloaking illegal?
Cloaking breaks the ad policies of Google, Meta and most ad networks, which suspend accounts for it. Whether a law is broken depends on what the hidden page does, such as selling banned products or taking payments for a scam. This is not legal advice.
What is a cloaker?
Software or a paid service that sits in front of a landing page and decides, visit by visit, whether to show the compliant page or the real one. It scores the visitor's IP, browser and context against lists of reviewer and bot traffic.
Why do cloaked ads show the real page to residential IPs?
Because reviewers and crawlers mostly browse from data-center and corporate networks. Sending the real page only to consumer ISP addresses in the target country keeps it away from most review systems, which is also why a check from a residential exit is how you see it.
Is SEO cloaking the same as ad cloaking?
Same technique, different audience. SEO cloaking shows search engine crawlers a page built to rank and users something else; ad cloaking hides from ad review. Google treats both as violations, under its spam policies for search and its ad policies for ads.