← All companies
🎭 Cloaking — how fraudsters hide from reviewers
To avoid being reviewed and taken down, one URL shows two different faces: a harmless page to ad reviewers and automated crawlers, and the scam to the real Mongolian user who tapped the ad. That is why ordinary monitoring marks these as “clean”.
How Bilig detects it
01We fetch the same URL in several personas at once: a plain desktop crawler, and a Mongolian user inside the Facebook/Instagram in-app browser (mn-MN locale, Ulaanbaatar timezone, mobile viewport, social referrer).
02We compare titles, content and final URLs. If the difference is more than responsive layout — a redirect to another domain or different content — cloaking is confirmed.
03Screenshots from every persona are archived as evidence.
A real case we found
The domain below does not use any specific company’s name, so this demonstrates the method without accusing anyone. Detected 2026-07-29.
🎭 Cloaking probe
Fraudsters show ad reviewers a harmless page and real users the scam. Bilig fetches one URL in multiple personas (plain crawler vs a Mongolian user arriving from Facebook/Instagram) to expose the difference.
mongolia-win.site
🤖 What a crawler sees
«mongolia-win.site | 523: Origin is unreachable»
mongolia-win.site
📱 What a Mongolian user sees
«Pixel warriors»
icefishing.postmortemshiller.ink
⚠ redirected to another domain
⚠ Limitations (stated honestly)
Cloaking often keys on IP geolocation. Our probe currently runs without a Mongolian IP, so some cloaks may not open for us. Screenshots sent by the public — a real Mongolian user’s view — close that gap.
Bilig is not an official representative of this company. This report is the result of open-source monitoring and is for informational purposes.