Selective delivery is a tactic where a website shows different content to different visitors. A normal user may see a convincing download page, while a researcher, scanner, or sandbox gets a harmless page, an error, or no payload at all. Attackers use this to hide malicious code and reduce the chance that security tools will capture the real behavior.
In cyber security, selective delivery matters because it breaks simple analysis. It can be based on user-agent strings, IP reputation, referrers, cookies, browser fingerprinting, time of day, or JavaScript checks. This allows phishing pages, fake installers, and exploit kits to evade automated review and stay active longer. Defenders look for inconsistent responses, test sites from multiple networks and browsers, and correlate web telemetry with endpoint activity to spot these evasive patterns.