A per-visit fingerprint check kept a live malware page rated clean for months

The gate runs before anything malicious loads. It reads the requester, picks a branch, then serves. Jones counted four outcomes from one link and one cloaker, and says the datacenter branch was the only page any scanner reached ^[5]. Three of the four branches were never observed by an engine that checked ^[1].

That makes a verdict a record of one fetch. Under a cloak, Jones wrote, a clean verdict is a true statement about the observation and a false statement about the URL ^[17]. The reputation services he queried returned clean verdicts consistent with having been handed the skeleton ^[7]. The link reached customers through the sender's real click-tracker, on a domain that passed every email authentication check ^[8].

Freshness is the second problem. A cache entry keyed on a URL has to hold for as long as the entry lives, and Jones says these pages rotate what they serve between visits, so a result from last week describes a page that no longer exists ^[10].

His test is a comparison. Load the same URL from datacenter, residential and mobile profiles at once, then look at where they disagree ^[13]. Here the disagreement was blank and benign from the scanner and a forced malware download from the phone ^[14]. That is three fetches per link, two of them over networks a datacenter scanner does not operate ^[2].

Two of the packages behind the gate shipped a forced auto-update channel that checks on every launch, runs in the background, and accepts any version the operator offers ^[12]. Jones also describes a second layer that starts examining whoever clears the gate ^[19].

Now the limits. His post does not name the reputation services it checked, give a false-negative rate, or say what a multi-vantage probe costs per link ^[20]. urlscan.io filed the page as one of "10,000+ similar pages" ^[6]. That counts pages resembling this one. It is not a share of links that cloak. Trinity Cyber's victims arrived by mistyping a domain, and Jones's arrived through an authenticated marketing email ^[16].

So the narrow claim is the one this evidence carries: a clean result from a single datacenter IP describes that fetch, and Jones says a single datacenter IP running a headless browser is the exact profile the cloak is tuned to feed a clean page ^[18]. Prevalence is not established here. His screenshots of the sorting gate and of the payload are dated June 13 and June 25, 2026 ^[21], and he says the machinery is still running ^[22].