Website cloaking is a technique that enables websites to deliver different content to
different clients, with the goal of hiding particular content from certain clients. Website cloaking is based on client detection, which is achieved via browser fingerprinting. In an
attempt to hide their malicious web pages from detection, cyber criminals (can) use cloaking.
They use vulnerability detection to only target clients that seem vulnerable. On top
of that, they (can) also provide benign content in case they suspect someone or something is
trying to detect them.

In this work, we investigated to what extent security web crawlers can be detected
by browser fingerprinting techniques, and provided some suggestions for how to improve them
to be able to bypass those techniques. We surveyed security analysts and analyzed a set of
threat intelligence sharing communities, to gauge awareness of cloaking as an available
detection evasion method for cybercriminals. Finally, we investigated one final technique,
the use of Cache-Control: no-store, which an attacker can use to thwart
forensic analysis.