The malware that shows scanners a clean page

A malicious landing page serves a clean page to scanners while delivering malware to legitimate visitors. This deceptive tactic evades reputation engines as each scans from a single data center IP, leading them to perceive the harmless skeleton page instead of the actual payload. Daniel Jones, founder of Tuxxin LLC, encountered a real-life example involving a Carnival Cruise Line email containing malware installers and locked screens.

The email, complete with booking information, directed unsuspecting customers towards the malicious content. Scanners guarding inboxes and browsers failed to detect any issues, while the investigation revealed the true nature of the threat. The malicious landing page fingerprints visitors, determining whether they are scanners or real users, and serves a tailored response accordingly.

The detection problem lies in the fact that reputation engines only evaluate the site from a single IP address, missing the real behavior when observed from multiple vantage points. This cloaking mechanism is cheap to run and templated, making it easily deployable. One link can lead to four different outcomes: scanners receive a harmless skeleton, while genuine browsers on real networks are routed to the live payload.

The malicious page inherits full brand trust due to the sender's reputation, arriving through a legitimate click-tracker and a domain that passed all email authentication checks. The detection issue arises when treating a scan result as a property of the URL rather than an observation of a single moment from a specific network. Treating a clean verdict as evidence of the URL's inherent safety is where the reasoning breaks down.

To address this, scanning from multiple profiles, including datacenter, residential, and mobile, is necessary to uncover the discrepancy between the clean page and the actual malware download.