Definition
Infrastructure-hiding techniques are the methods scam operators use to obscure who is running an operation and to prevent automated security tooling from ever reaching their actual content — distinct from the social-engineering tactics used against victims. Two independent techniques show up repeatedly: hiding the origin server's identity, and screening out automated scanners so only real, human visitors ever see the scam content.
How It Compares
| CDN-based anonymity | Bot-detection evasion | |
|---|---|---|
| What it hides | The origin server's real IP address and hosting provider | The scam page's content itself, from automated scanners |
| How it works | Runs behind commodity DDoS-protection/CDN services (Cloudflare, Google), which front the real server | Runs a small client-side challenge (e.g. a proof-of-work puzzle) that only completes for real browsers behaving like real visitors |
| Why scammers want it | Makes attribution and takedown harder — investigators and law enforcement can't reach the origin directly | Makes the page invisible to the automated scanners researchers and security vendors use to flag malicious sites at scale |
| Collateral effect | The same privacy feature that protects scammers is foundational to how the internet works generally, so providers can't simply remove it | Scanners that don't run the challenge see only a generic "suspended" or dead-looking page — the page appears to be nothing worth flagging |
The Evidence
CDN-based anonymity: across four unrelated scams analyzed in the same week, all four used Cloudflare or Google in front of their infrastructure — specifically for the DDoS protection these services provide, which has the side effect of hiding the origin server's IP address. That privacy makes it harder to attribute the infrastructure back to an operator, harder for researchers to run takedown efforts, and increases the number of warrants law enforcement need to pursue in order to trace it. Compounding the problem: platform providers appear to extend this privacy protection even after a successful takedown request — a takedown notice typically returns only a status confirmation email, with no further infrastructure detail released to the reporter, even though that detail is exactly what's needed to make further progress.
Bot-detection evasion: a website that appeared completely dead — showing only a generic "this domain has been suspended" notice, the kind hosting providers generate routinely — turned out to have run a screening test before it was taken down. The homepage rendered almost nothing visible; instead it quietly executed a small program in the browser that solved a tiny puzzle (a scrap of encrypted text, decryptable using a password baked into the code) before letting the visitor through to the real content. Automated security scanners — the kind researchers and vendors use to flag malicious sites at scale — routinely skip pages like this because they never execute the puzzle; real visitors browsing normally run it without noticing anything unusual. The file running that puzzle has been linked by malware researchers to a hacking group tied to North Korea, and the identical file has turned up on at least five other throwaway websites since June, each built to look like something else entirely — in one case, a fake banking service in the Dominican Republic. The infrastructure behind it was free hosting and a free domain — the sophistication was entirely in the one design decision to behave differently for people than for machines.
What To Do About It
For security researchers and platform teams:
- Don't rely solely on automated scanners for detection — build in an execution step (e.g. running a headless browser through any client-side challenge) so pages that screen out non-JS scanners still get evaluated as a real visitor would see them.
- When filing takedown requests with CDN/DDoS-protection providers, ask explicitly what post-takedown infrastructure detail (if any) the provider is willing to share — the default response is often a status email with no actionable detail.
- Track known evasion-script file hashes/signatures across investigations — the same proof-of-work file reused across multiple unrelated-looking scam sites is a strong linking signal between otherwise disconnected campaigns.
For individual users:
- Don't assume a "domain suspended" or dead-looking page means there's nothing to investigate — a scam site's live and dead states can look identical to a quick glance.
- Report suspicious infrastructure (domain, hosting provider, any observed behavior) even when a takedown has already happened elsewhere, since linking repeated infrastructure across campaigns is often more valuable than any single takedown.
Caveats & Edge Cases
This is methodology/meta content rather than a single-incident report, and it's technical/researcher-oriented — the CDN-anonymity privacy feature described here is also foundational to how the ordinary internet functions, so it isn't something that can or should simply be removed; the actionable lever is around takedown-request transparency, not the underlying privacy technology itself.