Malte ZanderContents
Automated visual comparison takes a screenshot of the suspicious page, detects logos, layout, colours, text and form fields and compares them with your real reference pages. High similarity on a foreign domain is a strong signal of a fake. People still have to decide, because partners, resellers, the press and comparison sites often show your logo quite legitimately.
- The research system Phishpedia identifies phishing pages by finding logos in screenshots and comparing them with the logos of known brands. It needs no training on phishing examples (USENIX Security 2021).
- Applied to new domains from certificate logs, Phishpedia found 1,704 phishing pages in one month, 1,133 of them previously unknown (Phishpedia).
- In July 2025, Okta reported that attackers used the AI tool v0 to rebuild the login pages of several brands (Okta).
- In an analysis of 112,005 phishing websites, 31.3 percent used tricks that show the content only to certain visitors (Zhang et al., IEEE S&P 2021).
Why isn't the domain name enough?
Because many fakes don't have a telltale domain. Lookalike domains such as your-brand-login.com can be found by name. But phishing pages also sit on hacked websites with completely different names, on random domains or on subdomains of platforms. What all these fakes share is their appearance: they have to look like your page, or nobody falls for them. That's exactly where visual comparison comes in.
What gets compared?
| Feature | What is checked | Limit |
|---|---|---|
| Logo | Whether your logo or a variant is visible | Pages without a logo or with a slightly altered one |
| Layout | Structure, spacing, arrangement of elements | Redesigned fakes, for example built with AI |
| Colours and type | Your brand's typical design | Many brands use similar colours |
| Text | Headings, notices, footers | Translated or reworded text |
| Form fields | Fields for passwords, cards, codes | Forms that only appear after a click |
| Embedded files | Identical images and stylesheets | Fakes with their own copies |
A single feature says little. Only the combination of high similarity, a foreign domain and a form for sensitive data adds up to a solid suspicion.
How does the comparison work technically?
In four steps. A crawler opens the suspicious address and takes a screenshot. A model looks for logos and form fields in it. The elements found, and the page as a whole, are compared with your reference pages and turned into a similarity score. Finally, other signals come in, such as the domain's age, its certificate and whether the domain belongs to you or a partner.
Researchers call this reference-based detection: instead of only reporting "phishing or not", the system says which brand is being imitated. Phishpedia showed that this works without training on phishing examples and found more than a thousand previously unknown phishing pages in a month (Phishpedia).
Why do reference pages matter so much?
Because the system can only recognise what it knows. Register the pages criminals like to copy most: login, checkout, contact form, support page and, if you issue certificates, the verification page. Include language versions and mobile views, because fakes often copy the mobile version. Update the references when you change your design, otherwise old fakes look less like your new page than your own old page does.
Where are the limits?
In four places:
Hidden content: if a page shows the crawler something different from what victims see, the system compares the wrong page. Almost one in three phishing websites in the CrawlPhish study used such tricks. More in Hidden fakes.
Pages without a logo: some fakes manage without one, such as plain text pages for fake support.
Redesigned fakes: AI tools build pages that only resemble your design instead of copying it. The distance to the reference grows.
Dynamic pages: content that only appears after clicks is missing from a simple screenshot.
That's why visual comparison belongs in a chain with other signals: domain monitoring, certificate logs and tips from customers through a report widget.
Where do people decide?
On everything beyond the suspicion. Your logo appears legitimately at resellers, partners, in press articles, on comparison sites and in training materials. A machine sees high similarity there; a person recognises the context. So review every hit before anything is reported, and keep an ignore list of known partners. Why that matters so much is explained in Human in the loop.
What does the comparison add to a report?
A strong piece of evidence. A side-by-side comparison of fake and original, with the matches marked, convinces abuse teams faster than any description. Attach it to every report, together with the screenshot, the full URL and the data from Securing evidence of a fake website.
How does AI Fraud Protect help?
AI Fraud Protect compares suspicious pages with your reference pages and flags cloned websites, phishing pages and fake verification pages. Every hit is created with an evidence package, partners sit on an ignore list, and a person reviews every case before reports go out to the host, registrar, DNS provider and Google Safe Browsing.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
Does AI detect every fake page?
No. Visual comparison finds many fakes that don't stand out by domain name, but it fails on hidden content and heavily altered copies. Combine it with other sources.
How many false alarms does it produce?
That depends on thresholds, references and ignore lists. Without human review, no hit should be reported.
Do I need separate reference pages for each language?
Yes, if the pages differ noticeably. Fakes often copy the language of their target group.
Is the comparison evidence in itself?
It's a strong indication and a good attachment to a report. Legal proceedings also need raw data, a log and checksums.
Sources
Lin et al.: Phishpedia, A Hybrid Deep Learning Based Approach to Visually Identify Phishing Webpages, USENIX Security 2021
Okta Threat Intelligence: v0 used to build phishing sites, 1 July 2025
Zhang et al.: CrawlPhish, Large-scale Analysis of Client-side Cloaking Techniques in Phishing, IEEE Symposium on Security and Privacy 2021