Malte ZanderContents
Many fakes are invisible to search engines and scanners because they only work with a specific link, such as one from a QR code or a phishing email. That makes the people holding that link your best source: customers, verifiers, authorities, partners and your own staff. A report widget on your website turns their suspicion into a case in one step, with the full link and without scattered emails.
- In a study of 112,005 phishing sites, 31.3% used client-side cloaking, showing their content only under certain conditions (CrawlPhish).
- In a study of 286,237 phishing URLs, Google Safe Browsing detected only 18.41% of the pages (Lee et al.).
- In 2024, the Swiss Federal Office for Cybersecurity received 975,309 reports through antiphishing.ch and confirmed 20,872 phishing sites (BACS).
- For a notice under the EU Digital Services Act, hosts need the exact URL, among other details (DSA, Article 16).
Why can't any search find these fakes?
Because they are built so that only their victims see them. A fake verification page shows "certificate valid" only when it is opened with the parameters from the QR code. A phishing page checks whether a person arrives with the right link and shows scanners a harmless page instead. Add long subdomains that start with your name, under a domain that has nothing to do with you.
For domain scanners and search engines, there is little to find. No variant of your domain leads there, and without the parameters the page shows nothing that points to you. Hidden fakes explains how these pages work.
Who sees the link first?
Almost never you. Five groups see the fake earlier:
| Group | Where they see the link | What they can report |
|---|---|---|
| Customers | In emails, texts, ads or chats | The link from the message, often with a screenshot |
| Verifiers in HR and authorities | In the QR code or link on a certificate they were given | The full link or the certificate as a PDF |
| Partners and resellers | In questions from their own customers | Domains and offers posing as you |
| Your own staff and support | In tickets and inquiries | Links from customer requests |
| Security researchers | In their own investigations | Whole groups of related sites |
Each of these groups holds part of the picture you are missing. A report widget gives them all the same way to pass it on to you.
What makes a good report widget?
Six properties decide whether it gets used and whether the reports are any good:
It sits where doubt arises: on your website, on the login page and on the results or verification page.
It asks for the full link, because only then can a host find a page that shows nothing without its parameters. Anyone holding a certificate can upload it as a PDF.
It takes one step, with no account and no long forms.
It keeps spam out, for example with a captcha and a limit per sender.
It speaks the reporter's language.
All reports land in one place, instead of scattered across the inboxes of individual teams.
What happens to a report?
It becomes a case if it is one, and is cleanly filtered out otherwise. A proven flow:
Intake: the link or PDF arrives with a timestamp and an optional description.
Analysis: the page is opened, captured in a screenshot and compared with your real page.
Matching: if the domain is your own or a partner's, the report ends here. If it belongs to a known case, it is linked to it.
Conversion: a new fake becomes a case, with an evidence package.
Takedown: reports to the host, registrar, DNS provider and Google until the page is offline.
The Swiss figures show why the first three steps matter: out of almost a million reports to antiphishing.ch, around 21,000 concerned confirmed phishing sites. Without automatic analysis and matching, any team drowns in tips.
How do you make the widget known?
A widget nobody knows about reports nothing. These places work well:
On certificates and verification pages, with one short line: "Doubts about this certificate? Report it here."
On your security page, next to the list of your official domains.
In warnings to customers when you warn them about a fake. See How to warn customers about a fake website.
In your support team's canned replies, so suspicious links don't end up buried in a ticket.
With HR teams, authorities and partners who regularly check your certificates or offers.
How does AI Fraud Protect help?
You embed the AI Fraud Protect report widget with one line of code on your website, your login page and your verification page. You set position, color and language yourself, in English or German. Anyone in doubt reports the link or uploads the certificate as a PDF, and an image captcha and a limit per IP address keep spam out. The AI analyzes every report with a screenshot, your own domains and partners sit on the ignore list, and new fakes become cases with an evidence package. For reports through the widget, the full link is included automatically.
Start the free fraud scan for a short report within 48 hours, or request a demo to see the report widget in the app.
FAQ
Where should the report widget go?
Where people have doubts: on your website, your login page and your results or verification page. The verification page matters most, because that is where employers and authorities arrive with the suspicious certificate.
How do we prevent spam?
With a captcha and a limit per sender. Automatic matching filters out duplicate and harmless reports before a person has to look at them.
What do reporters need?
Just the link or the certificate. A short description helps but is optional. The less the form asks for, the more often it gets used.
What about data protection?
Collect only what the check requires, and describe the form in your privacy notice. Work out the details with your data protection officer. This is not legal advice.
Sources
Zhang et al.: CrawlPhish, IEEE Symposium on Security and Privacy 2021
Lee et al.: study on the lifespan of phishing pages, The Web Conference 2025