A cloaked link serves a clean page to scanners and malware to real visitors. Every reputation engine that checked one recent case rated it safe for months, because each engine looked from a single datacenter IP. Seeing the real behavior takes loading the same URL from several vantage points at once.
By Daniel Jones, Founder, Tuxxin LLC.
Most link checks ask one question from one place, then report what came back.
That worked when a bad link was bad for everyone. It stopped working when attackers started deciding what to show based on who appears to be asking.
I ran into a textbook case earlier in 2026. A fully authenticated Carnival Cruise Line email, booking number and all, routed real customers into malware installers and fullscreen lockers. The scanners that guard inboxes and browsers saw nothing wrong.
