Malte ZanderContents
Fake websites come back because a new domain costs a few euros and the operators simply reuse their templates, servers and routines. A takedown removes one copy, not the operator. If you keep watching closed cases, track new domains and certificates that use your name and report returning copies with a reference to the old case, every new round gets much shorter.
- The phishing platform LabHost, taken down in 2024, offered more than 170 templates for fake websites (The Record).
- Investigators linked at least 40,000 phishing domains and about 10,000 users to LabHost (BleepingComputer).
- Phishing pages whose appearance changed more than 100 times stayed online for a median of 17 days, compared with 1.93 hours for pages with few changes (Lee et al., WWW 2025).
- Chrome only trusts publicly issued certificates that appear in Certificate Transparency logs, so new certificates for lookalike domains are publicly visible (Chrome).
Why do fake sites come back?
Because a takedown only hits the shell. The operator loses a domain or a hosting account but keeps everything needed for the next copy: the phishing kit or shop template, the victim list, the payment routes and the knowledge of which providers react slowly. A new domain is registered in minutes and often costs just a few euros.
On top of that, fraud runs on a division of labour. Platforms like LabHost sold ready-made templates to thousands of users, and investigators found at least 40,000 domains linked to that single platform. When one copy falls, the same user or another one sets up the next. What's inside such kits is explained in Phishing kits.
How do you tell it's the same fake?
From traces operators rarely change:
The same files: images, scripts and stylesheets with identical content or file names.
The same text: wording, typos and translation errors repeat.
The same infrastructure: host, IP range, name servers or registrar change less often than the domain.
The same naming pattern: your-brand-login, your-brand-service, your-brand-verify with changing extensions.
The same lure: the same email template, the same ad, the same QR code sticker.
The more of these match, the more certain the link. How to connect cases systematically is in Linking cases: when several fakes come from the same actor.
Where do copies reappear?
Usually close to the last one. Typical patterns are the same domain with a different extension, such as .net instead of .com, a similar name with a different add-on, a subdomain on a free hosting service or the same page at a provider that reacts more slowly. Campaigns using QR codes or ads often swap only the destination while the lure stays.
Well-maintained fakes are the most persistent. In a study presented at the ACM Web Conference 2025, phishing pages that kept adapting their appearance stayed online for a median of 17 days, while barely changed pages disappeared after just under two hours (Lee et al., WWW 2025). An operator who maintains a page like that will put it back up after a takedown too.
How do you keep watching closed cases?
With a short list of fixed checks:
Old addresses: Check removed URLs at regular intervals. Some pages return at the same address when a suspended account is reactivated.
New domains: Watch registrations using your name, common typos and confusable characters.
Certificates: Almost every fake uses HTTPS, and public certificates appear in Certificate Transparency logs. A new certificate for a confusable name is often the first signal.
Infrastructure: Check whether new domains with your name appear on IP ranges or name servers known from earlier cases.
Tips from outside: Customers, partners and verifiers see links your monitoring never sees. A report widget on your website gives them a fixed place for that, more in The report widget.
How do you report a comeback?
With a reference to the old case. Give the earlier address, the date of the first report and the ticket number, and show which features match. For hosts and registrars, that's a strong signal: they see a pattern, not a one-off. Ask the registrar explicitly whether the same registrant has registered other domains that imitate your brand.
| Situation | Request to the provider |
|---|---|
| Same page, new domain at the same registrar | Suspension and a check of other domains by the same registrant |
| Same page, new host | Removal with a reference to the earlier case and its evidence |
| Old address active again | Suspension again and a check of how the account was reactivated |
| New lookalike domain without content | Watch and collect evidence, report as soon as content appears |
What helps against comebacks for good?
No single measure, but a combination. A UDRP complaint transfers a particularly harmful domain to you so it can't be used again. A registered trademark strengthens every report and every dispute. Registering common typo domains yourself takes the most obvious addresses away from the operators. And clear guidance to your customers on which addresses are genuine makes every new copy less effective. Whether legal action pays off is covered in Takedown or legal action.
How does AI Fraud Protect help?
AI Fraud Protect doesn't lose sight of closed cases. New finds are matched against earlier cases and linked as comebacks. The new report is prepared with a reference to the old case, and a person reviews and sends it. Tips from the report widget flow into the same case list.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
How long should I watch a closed case?
At least a few weeks, and permanently for persistent fakes. Many copies reappear in the days after the takedown, maintained campaigns months later.
Can I stop someone registering a similar domain?
Not completely. You can register common variants yourself and act against abusive registrations if you hold a trademark. Seeing new registrations early matters more.
Is it worth reporting to the same host again?
Yes, especially with a reference to the old case. If a host repeatedly fails to react, focus on the registrar, browser warnings and escalation.
Is a recurring fake a case for the police?
If there are victims, yes. A criminal complaint documents the case, and linked cases with shared traces are especially valuable to investigators.
Sources
The Record: LabHost shut down in a global operation, 18 April 2024
BleepingComputer: LabHost disrupted, 18 April 2024
Lee, Lim, Kim, Kwon, Kim: 7 Days Later, Analyzing Phishing-Site Lifespan After Detected, ACM Web Conference 2025