Clone Phishing Detection & Takedown Guide

If someone clones your website and puts it on a lookalike domain, your users won't know the difference. Their credentials get stolen, sessions get hijacked, and by the time you find out.

I work in bot detection and phishing protection. This is a practical guide to detecting clone phishing sites that impersonate your brand, taking them down, and protecting users whose credentials were already stolen.

How to Detect Clone Phishing Sites That Impersonate Your Brand

Effective detection means proactive, continuous scanning — not waiting for user reports or blocklist updates. The average time to discover a phishing domain is 42.4 days, and Google Safe Browsing misses 84% of phishing sites. You need to find clones yourself. Or use a service that does it for you. Botbye runs continuous domain monitoring and content matching automatically. You add your domain, and it handles detection across all three attack types: HTML clones, reverse proxy setups, and custom-built pages.

1. Domain Monitoring

Continuously scan for newly registered domains that are typosquatted or visually similar to yours. Automated systems catch registrations within hours.

What to monitor for:

• Character substitution: yourconpany.com, y0urcompany.com
• Missing/extra characters: yourcompny.com, yourcompanny.com
• Hyphenation tricks: your-company-login.com
• TLD variations: yourcompany.net, yourcompany.io
• Combosquatting: yourcompany-verify.com, login-yourcompany.com
• Homograph attacks: аpple.com (Cyrillic "а" U+0430 vs Latin "a" U+0061)
• Subdomain tricks: yourcompany.fake.com

Tools:

# Scan for typosquatted domains
dnstwist --registered yoursite.com

# Monitor Certificate Transparency logs
curl -s "https://crt.sh/?q=%25yourcompany%25&output=json" | \
  jq -r '.[].name_value' | sort -u

Homograph attacks deserve special attention. A domain like yоurcompany.com (Cyrillic "о") is encoded as Punycode in DNS (xn--yurcompany-lfb.com), but browsers may display the Unicode version. Chrome and Firefox show Punycode when scripts are mixed, but not when the entire domain uses one non-Latin script. Password managers are your best defense here — they bind credentials to exact domains and won't autofill on lookalikes.

2. Content and Visual Matching

• HTML similarity — DOM structure, CSS classes, JS patterns. Tools like ssdeep (fuzzy hashing) work well.
• Visual comparison — screenshot-based comparison using perceptual hashing catches both exact clones and custom-built imitations.
• Text fingerprinting — track unique microcopy that clones would replicate.

# Simple HTML similarity check with ssdeep
import ssdeep

your_page = ssdeep.hash(open("your_login.html").read())
suspect_page = ssdeep.hash(open("suspect_page.html").read())
similarity = ssdeep.compare(your_page, suspect_page)
print(f"Similarity: {similarity}%")

3. Embedded Asset Tracking

When your JavaScript, images, or tracking pixels appear on domains you don't control, that's a strong clone signal. Attackers who copy your HTML often forget to remove embedded third-party scripts — analytics tags, chat widgets, tracking pixels. If any of these report back to you from an unknown domain, you've found a clone.

4. Reverse Proxy Detection

Reverse proxy phishing (Evilginx, Tycoon 2FA) is harder because requests DO reach your real server. Look for:

• Origin mismatches — login requests where the Referer or Origin header doesn't match your domain
• Session anomalies — user authenticates from one IP, session used from another within seconds
• Timing patterns — latency consistent with proxied traffic

5. Evilginx-Specific Detection

Evilginx is the most widely used reverse proxy phishing framework. 62% of phishing kits now use Tycoon 2FA architecture, which shares core techniques with Evilginx. Targeted detection:

• CT log monitoring — Evilginx requires TLS certs for phishing domains. Monitor CT logs for certs issued to domains resembling yours.
• Header analysis — Evilginx modifies certain headers. Look for inconsistencies in X-Forwarded-For, Host mismatches, or unexpected Via headers.
• JS environment fingerprinting — inject checks on your login page that verify window.location matches your domain, detect timing discrepancies in resource loading.
• Session token behavior — in Evilginx attacks, the attacker captures session tokens immediately after auth. Monitor for tokens used from a different IP within seconds of being issued.

What to Do When You Find a Phishing Clone

Detection without action is wasted effort. Once you find a clone, speed matters.

Step 1: Document Everything

Before anything else, capture:

• Full URL and timestamped screenshots of the phishing site
• WHOIS data
• Page source code
• Infrastructure info: hosting provider, IP, SSL cert issuer

Step 2: Initiate Takedown

File abuse reports with hosting provider AND domain registrar simultaneously. Include screenshots, WHOIS records, trademark proof, and timestamps.

Most hosting providers respond within 24-48 hours. For bulletproof hosting that ignores abuse reports, escalate to the registrar and upstream network providers.

Step 3: Submit to Blocklists

Report the URL to:

• Google Safe Browsing
• Microsoft SmartScreen
• PhishTank
• Netcraft

Won't take the site down, but triggers browser warnings — reducing the blast radius.

Step 4: Counter-Attack (When Your Code Is on Their Page)

If the clone still loads your JavaScript:

• Redirect visitors to your real site
• Display a fraud warning overlay
• Intercept credential submissions before they reach the attacker

This is temporary — attackers will strip your code — but buys time during the takedown window.

Step 5: Monitor for Re-Emergence

Attackers rarely stop at one domain. After takedown, watch for:

• New registrations matching the same pattern
• Same phishing kit on different infrastructure
• The PhaaS platform that supplied the original kit

How to Protect Users Who Already Fell for It

This is the part most teams skip — and it's critical. Even after you take down the clone, the damage to individual users is already done.

Flag Compromised Accounts

Any user who authenticated through a phishing clone has compromised credentials. In the case of reverse proxy phishing, the attacker may also have active session tokens.

• Forced password resets for affected accounts
• Mandatory MFA re-enrollment — if reverse proxy attack, existing MFA tokens may also be compromised
• Session invalidation — revoke all active sessions
• Elevated risk scoring — flag for suspicious activity monitoring

Connect Phishing Intelligence to Your Security Stack

Stolen credentials feed into longer attack chains: credential stuffing, account takeover, fraud. Your bot protection and fraud detection systems should receive phishing intelligence as an input signal — if you know credentials were stolen, you can proactively block automated login attempts using them.

Notify Affected Users

Transparency protects trust. Inform users that:

• Their account may have been compromised
• What security actions you've taken
• They should change passwords on other sites using the same credentials

IBM's 2025 Cost of a Data Breach report puts phishing-originated breaches at $4.44 million average. Skipping user protection is expensive.

Building a Complete Clone Phishing Defense

A sustainable defense checklist:

1. Automated domain monitoring — continuous scanning, not periodic manual checks
2. Multi-method detection — cover HTML clones, reverse proxy, and custom-built pages simultaneously
3. Streamlined takedowns — pre-drafted abuse report templates, established registrar relationships
4. Counter-attack capability — inject protective code into pages that copied yours
5. Compromised user flagging — automatic identification and protection
6. Integration with bot protection — feed phishing intelligence into bot detection to block credential stuffing and ATO that follow

These components work best as a unified system. Phishing detection that can't trigger user protection leaves a gap. Bot protection that doesn't know about compromised credentials can't prioritize the right accounts.

At BotBye, we've built phishing detection and bot protection as a single system — when a clone is detected, affected users are automatically flagged, and downstream bot attacks using stolen credentials are blocked. See how it works at botbye.com/anti-phishing.