A sponsored search result served an installer, but the same link now shows the vendor's real page - why?

## The plumbing, named A malvertising route has four parts and it helps to keep them separate: 1. **The account and the bid.** The operator opens an advertiser account and bids on the query people type when they want a specific tool - typically the product's own name, or `install <tool>`. Buying the brand's own name is legal, ordinary practice and cheap for niche terms. 2. **The creative.** What the searcher sees. The display string can be made to look like the real project's address while the click-through goes somewhere else entirely; the visual slot sits *above* the genuine organic result, so the attacker is the first thing on the page. 3. **The redirector.** A host the operator controls that receives every click and decides where to send it. This is where cloaking lives. 4. **The landing page.** A convincing download page whose only job is to offer a file. The SEO-poisoned variant swaps part 1 and 2 for content engineered to rank organically - long-tail installation queries, bulk-generated pages, or posts on compromised legitimate sites - and keeps parts 3 and 4 unchanged. Paid placement is instant and precisely keyword-targeted; ranking is free but slow and can be outranked. Operators use both. ## Why cloak at all Cloaking is not subtlety for its own sake; it is two concrete costs. - **Account survival.** Advertising platforms review creatives and destinations, and the review traffic is recognisable - it comes from the platform's own networks, at odd hours, often from a datacentre address with no referrer. If that reviewer is handed the genuine project site, the campaign is approved and keeps running. The account is the operator's inventory, and it costs money and identity documents to replace. - **Click spend.** Every click is billed. A visitor whose address sits in a hosting provider's range, or whose language and platform do not match the campaign, is unlikely ever to run the installer. Serving them the real site costs nothing and saves the operator from paying for a visit twice over. That second point is the giveaway about the class of operator behind this. Someone paying per click, bidding on a generic tool name, indifferent to which organisation the clicker works for, is running a commodity operation on bought infrastructure - a kit, an ad account, a redirector service. Contrast that with an operator who poisons a single sector's association page and waits: that one is buying a *specific readership* and paying in effort rather than in clicks. ## What the cloaking does to your reasoning The important consequence is epistemic. A URL is normally treated as a name for a destination. Behind a cloaking redirector it is not: it is a function whose arguments include your address, your platform, your language, your referrer and the time. So: - **`I opened it and it was fine` proves what that one request was handed.** It says nothing about what a colleague on a different network, on a different platform, twenty minutes earlier was handed. - The reverse also holds. A visitor who *was* served the installer is not contradicted by the page looking clean afterwards, and the campaign may simply have finished its budget for the day. - The chain is disposable by design. The redirector hostname, the landing hostname and the ad account are all cheap and rotate constantly; the *behaviour* - bid on the tool name, cloak, offer an installer - is what persists across campaigns. ## Why the search result is such a good position There is a piece of standard advice that this technique feeds on directly: **do not click links in messages - type the name into a search engine instead.** That advice is sound against message-based lures and it delivers the searcher straight into a slot the attacker has bought above the real answer. The person did everything they were told, chose the destination themselves, and chose the attacker's. It is also worth being precise about what was *not* involved: no defect in the browser, no defect in the search engine, no defect in the advertising platform. Buying a keyword and running a redirector are the platform working as designed. The only irregular thing is the file at the end.