How often cloaking actually happens

Everyone writing about cloaking agrees it is common in the grey end of search. Nobody says how common, because saying it requires measuring it, and measuring it requires being honest about what the measurement cannot see.

We ran one. This is what came out, including the parts that did not work.

What was measured

529 pages, each one ranking in Google for a brand query — the kind of query a company's own customers type. Four grey niches: gambling, pharmaceuticals, supplements, crypto. Six countries: the United States, Germany, Brazil, India, Kazakhstan, Turkey. Every page was opened several ways within minutes of itself: as a plain visitor, as a visitor arriving from a Google result, as something announcing itself as a search engine crawler, as a request coming out of Google's own network, and then as a plain visitor a second time.

That last one matters more than it sounds. Large pages change between two identical visits all by themselves — rotating banners, personalised blocks, A/B tests. Without a measurement of how much a page differs from itself, every busy homepage looks like cloaking.

Alongside the grey niches we checked 48 pages ranking for the brand queries of large, entirely legitimate companies — retailers, banks, carmakers. A control group.

The control group was the whole study

The first run said 30% of the legitimate pages were cloaking, against 18% for gambling.

That result is obviously wrong, and the wrongness is the useful part: honest sites were coming out dirtier than casinos. A cloaking check with no control group would have reported the 18% as a finding, and it would have been noise.

Four of the causes turned out to be ours.

Different countries were being compared. Some ways of looking at a page can only originate in the United States. Compare those with a visitor in Germany and you are comparing the German edition of a site with the American one. Nearly half of all the "cloaking" we had found was that.

A refusal was being read as a different page. When bot protection answers with a challenge instead of the page, the address it sends you to carries a random token. Two refusals in a row have two different addresses — which looked like a site steering visitors and crawlers to different places.

An empty page with a cheerful status code counted as a page. One large retailer answers a visitor with HTTP 200 and fourteen words — a wall asking you to prove you are human — while the crawler gets fifteen hundred words. "Crawler gets the page, human gets nothing" is the strongest cloaking signature there is, and here it meant only that we had been blocked.

A failed control was treated as a clean one. When the repeat visit did not come back, we no longer knew how much the page varies by itself, and carried on comparing anyway.

After those four, the control group fell to 2 pages out of 46.

The numbers

On the same 529 pages, re-run after the fixes:

Read it as an order of magnitude, not as a decimal. With 46 pages in the control group, the difference between two cases and four is luck. What the table supports is this: a page ranking for a gambling brand query is a few times more likely to show the search engine something other than the visitor than a page ranking for a legitimate brand — and the grey niches sit close together, well above the control.

It does not support "10% of gambling pages are cloaked." That number would need thousands of pages and more than one day, and anyone quoting a figure that precise from a sample this size is guessing.

The two legitimate pages that remain are real, incidentally, and worth knowing about: a bank whose scripts render substantially more text when the request announces itself as a crawler, and a marketplace that blocked every attempt we made. The first is cloaking by the strict definition and benign in intent. That distinction is not something a checker can make; it is something a person reads off the evidence.

"Not checked" is a result

85 of the 529 pages could not be compared at all. Bot protection, no response, a site that refused everything. They are not counted as clean and not counted as cloaking — they are counted as not checked, and the reason is recorded for each one.

This is a sixth of the sample. Any study of this kind that reports only two outcomes has either been lucky with its sample or has quietly folded its failures into one of the two buckets.

Geography

Within gambling, the same brand queries behaved differently by country: Germany and Kazakhstan came out several times higher than Brazil, India and Turkey, with the United States in between. Those slices are 17 to 49 pages each — too small to publish as findings, large enough to say that a single-country measurement of cloaking describes one country and not the web.

This is the same reason brand monitoring has to be set per country. A page that only exists for German visitors is not visible from anywhere else, by design.

The hacked pages

Four pages in the sample were on sites that had no business hosting them: three Brazilian government domains and a university, each serving gambling content from paths like /store/apps/details/?id=…. Nobody at those institutions decided to rank for casino queries. The sites were broken into and the pages injected.

For a brand, these are the most actionable finds in a list of infringements. A legitimate affiliate with a review page is a negotiation. A hacked government server is an email to the site owner and a report nobody argues with: the page is there against the owner's will, and showing them that is usually the whole conversation.

What a check can and cannot see

It catches a page that behaves differently for a visitor arriving from search, for something announcing itself as a crawler, for a request coming from inside Google's network, and for a repeat visit. It can compare what Google quotes in its own search result against what the page actually says — Google's snippet is the trace of the real crawler, and when it quotes text that is not on the page, something was shown to Google that is not being shown now.

It cannot see cloaking keyed strictly to the real crawler's IP addresses, except through that trace. It cannot tell intent. It cannot tell you that a site is clean — only that it showed the same thing to everyone who asked, in that minute, from that country.

Our free check is the same procedure, on one page, with every row of the comparison visible: serpward.com/check.