Cloaking and Redirect Chains: How Scam Ads Hide From Review

A scam ad gets submitted for review. The platform checks the destination URL, finds a clean, policy-compliant page, and approves the ad. Then real users start clicking and land somewhere entirely different: a fake shop selling counterfeits of your products, or collecting payment for goods that will never arrive.

This is not an edge case. It is a deliberate technique used by fraudsters running brand impersonation campaigns on Google, Meta, TikTok, and beyond. The method is called cloaking, and it is routinely combined with redirect chains and traffic distribution systems to make detection as difficult as possible.

Understanding how this works is the first step to understanding why platform reporting so often fails to stop it.

What Cloaking Actually Means

Cloaking is the practice of serving different content to different visitors based on signals that identify who they are. In paid advertising fraud, the goal is simple: show the platform reviewer a compliant page, and show everyone else the fake shop.

The fraudster's server evaluates each incoming request in real time and routes it accordingly.

IP-based cloaking

Platform review systems typically operate from known IP address ranges. Fraudsters maintain blocklists of these ranges. When a request arrives from a known review IP, the server routes it to the safe page. Everyone else gets the fake shop. It still works because platforms cannot rotate their review infrastructure fast enough to stay ahead of updated blocklists.

Device-based cloaking

Reviewers often use desktop environments with standard browser configurations. Scam ads targeting mobile users can serve the compliant page to desktop browsers while routing mobile users to the fraudulent destination. Device fingerprinting goes further: browser type, operating system, screen resolution, and how JavaScript behaves can all be used to distinguish a real user from a review environment.

Geo-based cloaking

Many scam campaigns are targeted at specific countries. The fake shop is only served to users in those locations. Reviewers operating from a different geography see the compliant page. A campaign targeting UK consumers can be configured to show the fake shop only to UK IP addresses, while anyone elsewhere sees something entirely harmless.

The combined effect: A single scam ad can apply IP, device, and geo signals simultaneously, making it highly unlikely that a standard platform review will ever encounter the fraudulent destination.

Traffic Distribution Systems

Cloaking describes the logic. Traffic distribution systems (TDS) are the infrastructure that executes it at scale. A TDS sits between the ad click and the final destination, evaluating every visitor against a ruleset before routing them. Legitimate marketing operations use TDS tools for split testing. Fraudsters use the same technology to run evasion at volume.

When a user clicks a scam ad, the TDS checks:

• The visitor's IP against blocklists of known platform crawlers
• Device type, browser, and operating system
• Geographic location
• Whether the visitor has been seen before, to avoid repeat visits that could trigger pattern detection
• Time of day, to avoid serving the fake destination during peak review hours

Visitors who pass all checks are routed to the fraudulent destination. Anyone else gets the clean page.

The practical result: the ad's declared destination URL, the one the platform reviewed and approved, never actually delivers the fraudulent content to anyone the fraudster wants to avoid.

TDS setups also allow operators to run multiple fake shop destinations simultaneously. If one is flagged and taken down, traffic is automatically rerouted to another. The ad remains live and continues generating clicks while the operator rebuilds.

Redirect Chains: Distance Between the Ad and the Destination

Even without cloaking, redirect chains serve a separate purpose: they create distance between the approved ad URL and the final fraudulent destination.

A redirect chain is a sequence of URL hops. A user clicks the ad, lands on URL A, which immediately redirects to URL B, which redirects to URL C, until they reach the fake shop. Each hop takes milliseconds. The user experiences it as a single click.

Why redirect chains matter for evasion

• The platform only reviews the first URL. What happens after that redirect is outside the scope of most automated ad review processes.
• Intermediate domains can appear clean. Some chains pass through legitimate-looking domains, URL shorteners, or tracking links with no obvious connection to the fake shop.
• Individual hops can be swapped quickly. If one domain in the chain is flagged, the operator replaces it. The ad keeps running through a fresh intermediate URL.
• They obscure ownership. Each additional hop makes it harder to trace the chain back to the operator.

Redirect chains are often used alongside cloaking. The TDS sits at one of the intermediate hops and makes the routing decision before the user reaches the final destination. This means the fake shop URL never appears in the ad at all.

This layered approach is what makes these campaigns genuinely difficult to catch through standard platform reporting. For a closer look at how this plays out on Meta and TikTok, see the Remove.tech guide to fake Meta and TikTok ads. For Google-specific brand-bidding fraud, the Google scam ads breakdown covers the mechanics in detail.

How Detection Works Around These Techniques

Effective detection has to work differently from automated platform review, because these techniques are specifically designed to defeat it.

Simulating real user behaviour

One approach is to simulate the conditions that trigger the fake destination: using residential IP addresses (which do not appear on platform blocklists), matching genuine consumer device profiles, and accessing the ad from the target geography. This is how the actual fraudulent user experience can be observed rather than the clean page shown to reviewers.

Monitoring at brand level, not ad level

Platform review looks at individual ads in isolation. Brand-level monitoring looks at patterns: domains registered with your brand name, websites copying your product imagery, fake shop infrastructure appearing across multiple campaigns. This broader view can identify the fraudulent destination even when the ad itself appears clean.

Remove.tech's brand protection platform monitors across search engines, social media, marketplaces, and the open web for unauthorised use of brand identity. When a fake shop is identified, the focus is on the destination itself, not just the ad pointing to it. Taking down the destination disrupts the campaign regardless of how many redirect hops or cloaking layers sit in front of it.

Continuous monitoring matters

Cloaked campaigns are designed to be rebuilt quickly. A fake shop taken down today can reappear under a new domain within days. For brands already dealing with fake ads using their name, the pattern is familiar: one reported ad disappears and another appears shortly after, because the underlying infrastructure was never addressed. Continuous monitoring is the only approach that keeps pace with how these operations actually work.

What This Means for Your Brand

If your brand is being targeted by scam ads, standard platform reporting is likely not catching the full picture. The ads that get through review are not slipping through by accident. They are designed to pass.

A customer defrauded by a cloaked campaign does not know they were routed through a redirect chain. They know they searched for your brand, clicked what looked like your ad, and were scammed. The association stays with your name.

Brand protection that focuses only on what is visible in the ad interface misses the infrastructure that makes these campaigns work. If you want to understand what is currently using your brand name, Remove.tech offers a free brand audit covering fake websites, counterfeit listings, impersonation accounts, and unauthorised ad activity. It takes a few minutes to request and gives you a clearer picture before the next campaign goes live.

FAQ

What is ad cloaking?

Ad cloaking is the practice of showing a different page to platform reviewers than to real users. By serving a clean page to reviewers and routing genuine users to a fake shop, fraudsters get ads approved that would otherwise be rejected.

Can platforms detect cloaking automatically?

Platforms use automated systems, but these have known limitations. They operate from fixed IP ranges and identifiable browser configurations, both of which fraudsters detect and filter. More effective detection requires simulating genuine user behaviour from residential IPs in the target geography.

What is a redirect chain?

A sequence of URL hops between the ad click and the final destination. The user passes through several intermediate URLs before reaching the fake shop, each hop taking milliseconds. Redirect chains distance the approved ad URL from the fraudulent destination and make it easy to swap out flagged domains without changing the ad.

Why does reporting a scam ad often not work?

Standard reporting prompts the platform to review the URL in the ad. If cloaking is active, that review sees a clean page and the ad stays live. Even if removed, the fake shop and operator are unaffected. Without addressing the destination directly, the same operator relaunches quickly under a new URL.

Are these techniques used on platforms other than Google?

Yes. They are used across Meta (Facebook and Instagram) and TikTok too. The signals used to identify reviewers vary slightly by platform, but the approach is consistent. For more on how this works on social platforms, see the Remove.tech guide to fake Meta and TikTok ads.

How does Remove.tech deal with cloaked scam ads?

Remove.tech focuses on the destination rather than just the ad. Its platform monitors search engines, social media, marketplaces, and the open web for fake shops and lookalike domains using your brand, removes and de-indexes them through legal notices and its membership of Google’s Trusted Copyright Removal Program, and keeps watching for the same infrastructure reappearing under new domains.

‍