Referral-aware delivery is a web technique that changes the page content a visitor receives based on request context, such as the Referer header, source IP, user agent, or other signs of how the request arrived. In benign use, sites may customize landing pages or track marketing campaigns. In malicious use, it becomes an evasion method: scanners, crawlers, and reputation bots can be shown harmless content while real users are redirected to phishing pages or credential forms.
This matters in cyber security because it helps attackers hide malicious intent from automated review and delay takedown. It often appears alongside cloaking, lookalike domains, and SEO abuse, where a search result leads to different outcomes depending on whether the visitor seems like a bot or a human. Defenders should test suspicious pages from multiple contexts, inspect headers and redirects, and use headless browsing and network telemetry to compare what scanners see versus what users receive.