Malte ZanderContents
Archive a fake site before you report it, because many fakes are gone or changed within hours. The most solid approach is a combination: your own complete copy with all files, ideally in the WARC archive format, plus screenshots and, where appropriate, a copy in a public web archive as an independent timestamp. Open the page with the full link that victims received.
- Half the phishing pages in a study of 286,237 URLs were offline after 5.46 hours (Lee et al., WWW 2025).
- The WARC archive format is standardised as ISO 28500:2017. It stores content together with the control data of protocols such as HTTP and DNS (ISO).
- In an analysis of 112,005 phishing websites, 31.3 percent showed their content only to certain visitors. An archiving service may then see an empty page (Zhang et al., IEEE S&P 2021).
Why archive instead of only taking screenshots?
Because a screenshot is an image and an archived copy is the page itself. The copy contains the page source, the embedded files, form targets and often traces of the phishing kit used. That lets you answer questions later that nobody thought of at the time of the find: where did the form send the data? Which files does this fake share with an earlier one? For takedowns, linking cases and legal proceedings, that's invaluable. And because many fakes disappear within hours, there's often only one chance.
Public archive or your own copy?
Both have their place:
| Route | Benefits | Drawbacks |
|---|---|---|
| Public web archive, such as the Internet Archive's Save Page Now | Independent timestamp, fast, free | The copy is public, hidden content is often missing, operators can block archives |
| Your own copy in the WARC format | Complete, with HTTP data, standardised, private | Needs the right tools |
| Saving the page as a file | Simple, possible in the browser | Incomplete, dynamic content is missing |
| Screenshots | Show what people saw | No source, no files |
For most cases, this works: always your own copy and screenshots, a public archive in addition if the copy there shows no sensitive data. Check first whether the page displays victims' data, such as an email address prefilled from the link. Such links don't belong in a public archive.
What belongs in a complete archived copy?
The full URL with path and parameters.
The redirect chain, if the link passes through intermediate stops.
The page source of the page and every subpage in the flow.
Embedded files: images, stylesheets, scripts.
HTTP responses with status codes and headers.
Time, device and location of the capture.
The WARC format captures exactly that: it stores content together with the control data of the request (ISO). Many web archiving tools can produce WARC files, from browser extensions to command-line programs.
How do you go about it, step by step?
Work in isolation. Use a separate browser or a virtual machine, don't enter anything and don't download anything.
Use the full link. Fakes with parameters often show nothing without them. Use the link the victims received.
Check mobile and desktop. If the page reacts differently by device, archive both variants.
Make the copy. Your own WARC copy or a complete save, plus full-page screenshots.
Archive publicly, optionally. If no victim data is visible.
Checksums and log. SHA-256 for every file, plus who, when and with what. More in Chain of custody for digital evidence.
What if the page shows nothing when you archive it?
Then it's probably hiding. Some fakes check country of origin, device, referrer or one-time identifiers in the link and only show the content to matching visitors. Document the attempt anyway, with a screenshot of the empty page and the time, and describe the conditions under which victims saw the fake. A second attempt with a mobile device or the exact link from the phishing email often helps. The background is in Hidden fakes.
How long do you keep archived copies?
As long as the case might matter. At least until the fake is removed and a comeback is unlikely, longer if legal steps are possible. Archived copies also help months later, when a new fake appears and you want to show that it uses the same files. Set a retention period, protect the copies against changes and delete with documentation.
How does AI Fraud Protect help?
AI Fraud Protect secures every find automatically with screenshots, the full URL and registration, DNS, hosting and certificate data, before any report goes out. The evidence package stays with the case long after the fake is offline, and new finds are matched against earlier cases. A person reviews and sends every report.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
Is a copy in the Internet Archive evidence?
It's independent proof that a page looked a certain way at a certain time. For legal proceedings, add your own copy, a log and checksums.
Can the operator have the public copy deleted?
Web archives have their own rules for removal requests. So never rely on a public archive alone.
May I download a phishing page?
Saving it for evidence is common practice. But never run downloaded files, and store copies separately from your working network.
Do I need WARC, or is a saved web page enough?
For simple takedowns, the saved page with screenshots is often enough. For legal proceedings and linking cases, WARC is much stronger.
Sources
Lee, Lim, Kim, Kwon, Kim: 7 Days Later, Analyzing Phishing-Site Lifespan After Detected, ACM Web Conference 2025
ISO 28500:2017, Information and documentation, WARC file format
Zhang et al.: CrawlPhish, Large-scale Analysis of Client-side Cloaking Techniques in Phishing, IEEE Symposium on Security and Privacy 2021