A genuine Carnival Cruise Line booking confirmation routed customers to malware. The mail was authentic and passed SPF, DKIM and DMARC. The failure was a promotional domain Carnival had let lapse, still linked from live marketing mail, re-registered by someone else and wired into a redirection network. Carnival re-acquired the domain on August 26th, 2026, and I verified the vector dead the next day. The full path. A datacenter scanner only ever reached the clean parking page on the left. Real visitors reached the malware on the right. Credit where this work starts Trinity Cyber documented the redirection technique and the payload family in November 2025, in Blurred Lines: AdTech Abuse Delivers Browser Hijackers Through the Microsoft Store . Tanner Piliego and Jared Grumbein named the redirection layer PseudoTDS and the browser-hijacker family PhantomJack, and traced the initial redirects through the Trillion ad-tech network, formerly Trellian. Their report describes victims reaching that machinery by mistyping a domain. This report describes the same machinery reached through an authenticated marketing email, which is the part that is new. Both names in this article are theirs. What I add is the delivery path, a current set of indicators, and one payload behavior their report does not cover. What I did to confirm it On June 13th, 2026, I received a Players Club casino email from Carnival Cruise Line. It was a real booking confirmation carrying my own booking number, and all three authentication checks passed. I clicked one of its links on my own PC, the way any recipient would, and landed on a fake-security page pushing a download. I reread the address bar and ran it again. Same result. Then I checked it from a second computer and a different inbox belonging to another booked guest who received the same email. Same behavior, so nothing about it was specific to my account. From there I stopped clicking blind and started capturing, from public scanners, from my own servers in different parts of the world, and from my phone. The same link behaved differently depending on where I loaded it from. The cloak decides what you see The landing page fingerprints the visitor and routes on the result, per visit. Scanners, command-line tools and headless browsers fail that check and receive a benign skeleton. Real browsers on real networks reach a live payload. The gate that sorts visitors. Screenshot from cclpromos.com, June 13th, 2026. Point a scanner or a datacenter IP at that link and you get a clean, empty page. Load it on a phone or a home connection and it drops you into malware installers, scareware and fullscreen lockers. The public reputation services I checked returned clean verdicts throughout. Those results are consistent with the services having received the same skeleton page my automated checks did. When I ran the page through urlscan.io it came back flagged as one of "10,000+ similar pages," which points at a templated network rather than a one-off. What the click bought Here is what I observed. The domain resolved into a parked-domain monetization service. The content it returned changed with the visitor: automated clients received a compliant parking page, real browsers were handed to an advertiser, and which advertiser changed between visits. An advertiser network sits behind that domain, and the disclosure record establishes it. I reported individual advertisers to the monetization service and those advertisers came down. Something in that chain decides which advertiser a visitor reaches. Each removal had to be earned. The service acted on an advertiser once I had captured and handed over proof for that specific advertiser, which leaves the collection work with whoever happened to notice. Reporting a cloaked page is slow work, and doing it per advertiser is the slowest version of it. The removals did not fix anything. Each one was replaced, the entry domain stayed live, and the email link kept routing into it until Carnival re-acquired the domain on August 26th. Removing an advertiser treats the symptom, and the timeline in the disclosure section shows it. Why the split happens, as far as I can tell Why the traffic splits the way it does is my reading rather than a documented fact. The behavior is consistent with parked traffic being sorted by what it is worth: traffic that passes strict quality checks goes to the buyers with the strictest policies, and traffic that fails those checks, by geography, device or automation signals, moves elsewhere. On that reading, an automated checker resembles traffic the strict buyers accept and receives the compliant page, while a person on a phone is routed further down. It would explain why these domains test clean, and why anyone who checked one and found nothing was reading an accurate result. The commercial terms are the part I cannot see. I have no contract, no revenue figure and no visibility into what any party knew about a specific buyer, so this report des...