A clone is usually a mirror of your real site, which means it carries artefacts of your site. The useful signals are the ones an attacker would have to do extra work to remove — because most do not bother.
Cheap to change, costly to change
| Signal | Cost to an attacker | Detection value |
|---|---|---|
| Your brand name in the page text | Trivial to change, and they want it there | Low as a signal, high as confirmation |
| Your favicon, byte-identical | Easy to replace, usually forgotten | High |
| Hashes of your CSS or JS bundles | Requires rebuilding the site | High |
| Your analytics or tag-manager ID left in the HTML | One line to remove, very often left | High, and unambiguous |
| Absolute links back to your real domain | Requires rewriting, often partial | High |
| Your copyright string and footer | Trivial | Moderate |
| A login form posting to an unrelated host | Necessary for the attack to work | Highest — this is the attack itself |
The pattern is that the signals with the most value are the incidental ones. An attacker optimises the parts a victim looks at; the parts a victim never sees are copied verbatim and left.
Hashing what you control
Keep a record of, for your own site: sha256 of favicon.ico sha256 of each built CSS and JS bundle your analytics property IDs the exact copyright string Then for a suspicious host: fetch the same paths compare A byte-identical favicon on an unrelated domain is not a coincidence.
This works because a mirroring tool copies assets exactly. It stops working the moment an attacker rebuilds the page by hand, which a small minority do — and those are the ones the next lesson is about.
The form is the finding
Everything above establishes resemblance. A login form whose action posts to a host that is not yours establishes intent, and it is the single fact worth putting at the top of an abuse report.
Resemblance is not impersonation
A reseller, a partner, an archived copy, or a legitimate agency mock-up can all reproduce your site closely. What distinguishes a phishing clone is what it does with what it collects — a credential form, a payment form, a download. Lead with that, not with the resemblance.