Cloaking is the hinge that the rest of a malicious ad campaign turns on. A visitor arrives, something decides in a few milliseconds whether they are a real person or a check — an ad platform reviewer, a security scanner, a crawler — and serves them accordingly. Get past the cloak and you see the scam; fail it and you see a bland page about vitamins.
Most operators do not build that decision themselves. They buy it. This section profiles the kits and services that make the call: what each one is, how it is deployed, what it does to traffic, and which threat actors we have seen using it.