CertaDNS
Skip to lesson

Detecting a Clone · lesson 1 of 2

Signals that are costly to change

After this lesson you can

Detect a cloned site using artefacts an attacker would have to work to remove.

Assumes you have read Watching your own estate.

A clone is usually a mirror of your real site, which means it carries artefacts of your site. The useful signals are the ones an attacker would have to do extra work to remove — because most do not bother.

Cheap to change, costly to change

SignalCost to an attackerDetection value
Your brand name in the page textTrivial to change, and they want it thereLow as a signal, high as confirmation
Your favicon, byte-identicalEasy to replace, usually forgottenHigh
Hashes of your CSS or JS bundlesRequires rebuilding the siteHigh
Your analytics or tag-manager ID left in the HTMLOne line to remove, very often leftHigh, and unambiguous
Absolute links back to your real domainRequires rewriting, often partialHigh
Your copyright string and footerTrivialModerate
A login form posting to an unrelated hostNecessary for the attack to workHighest — this is the attack itself

The pattern is that the signals with the most value are the incidental ones. An attacker optimises the parts a victim looks at; the parts a victim never sees are copied verbatim and left.

Hashing what you control

Keep a record of, for your own site:
   sha256 of favicon.ico
   sha256 of each built CSS and JS bundle
   your analytics property IDs
   the exact copyright string

Then for a suspicious host:
   fetch the same paths
   compare

A byte-identical favicon on an unrelated domain is
not a coincidence.

This works because a mirroring tool copies assets exactly. It stops working the moment an attacker rebuilds the page by hand, which a small minority do — and those are the ones the next lesson is about.

The form is the finding

Everything above establishes resemblance. A login form whose action posts to a host that is not yours establishes intent, and it is the single fact worth putting at the top of an abuse report.

Resemblance is not impersonation

A reseller, a partner, an archived copy, or a legitimate agency mock-up can all reproduce your site closely. What distinguishes a phishing clone is what it does with what it collects — a credential form, a payment form, a download. Lead with that, not with the resemblance.

Knowledge check

Which clone signal is most valuable, and why?

Last reviewed