Malte ZanderContents
A phishing page steals credentials or payment data through a form. A clone site copies your whole brand to sell, take investments or collect leads. The difference decides the strongest ground for every report: phishing counts as DNS abuse that registrars of generic domains must act on, while a clone without a credential form usually rests on fraud, trademark and copyright. Name the case correctly, and every report moves faster.
- ICANN defines DNS abuse as malware, botnets, phishing, pharming and spam that delivers them. Registrars of generic domains must act on actionable evidence of it (ICANN).
- The UK regulator FCA describes clone firms as fake firms using the name, address and firm reference number of real authorized companies. Victims reported more than £78 million in losses in 2020 (FCA).
- In the EU, hosting providers must accept notices about any content the notifier considers illegal, from fraud to infringement of intellectual property (DSA, Article 16).
What is a phishing page?
A page whose main job is to collect secrets: passwords, one-time codes or card data. It usually copies a login or payment page, and the rest of the site often doesn't exist. See cloned login pages.
What is a clone site?
A copy of your website or brand presence as a whole: shop, product pages, team, contact details, sometimes your company registration data. The goal is money or credibility, through orders that never ship, investments into fake accounts, collected leads or, for certificates, fake confirmations.
The FCA's clone firms are a well-known variant. Scammers send sales material that links to a legitimate firm's website, so victims believe they deal with the real company (FCA).
How do clone sites and phishing pages compare?
| Phishing page | Clone site | |
|---|---|---|
| Goal | Credentials, codes, card data | Payments, orders, investments, leads |
| Typical scope | One or a few pages, such as login or payment | A whole site, often with your imprint and contact data |
| How victims arrive | Emails, texts, QR codes, ads | Ads, search results, social media, marketplaces |
| Strongest grounds | Phishing as DNS abuse, fraud | Fraud, trademark, copyright |
| Fastest channels | Host, registrar, Google Safe Browsing | Host with a DSA notice, registrar, ad platforms, payment providers |
| Key evidence | Form target, requested fields, the lure | Copied content side by side, fake company data, payment details |
Why does the difference matter for your reports?
Because each recipient checks your report against its own rules, and the wrong framing sends it to the wrong queue.
Registrars. Phishing falls under ICANN's DNS abuse definition, so registrars of generic domains must promptly take appropriate action on actionable evidence (ICANN). A clone shop without a credential form does not fall under that definition, so the registrar acts on its terms of service, fraud evidence or a dispute decision.
Hosts. In the EU, both cases are illegal content under Article 16 DSA. What counts is that you explain the illegality precisely enough for a diligent reviewer to see it without a detailed legal examination (DSA).
Copyright is often the simplest ground against a clone, because the copied texts, images and design are yours. See copyright as a takedown tool.
Trademark carries the case when the domain or an ad uses your brand: through dispute procedures such as UDRP or the trademark complaint forms of ad platforms (Google Ads).
A report that doesn't match what the reviewer sees gets bounced or waits in a slower queue. A report that names the right ground gets acted on.
What about mixed cases?
Many fakes are both: a cloned site with a login or checkout that collects card data. Lead with the ground that shows the most harm, usually phishing or fraud for the data form, and add trademark and copyright as supporting grounds.
Fake verification pages are a third case. They confirm forged certificates and need their own framing. See how fake verification pages work.
How do you decide in practice?
Ask three questions about what the page does, not what it looks like:
Does it ask for login data, codes or card details? Then frame it as phishing.
Does it copy your brand to sell, take investments or collect contacts? Then frame it as brand forgery.
Does it confirm documents or certificates? Then frame it as certificate forgery.
If several apply, lead with the framing that shows the most harm and mention the others. The complete channel list is in How to report a phishing website in Europe.
Start the free fraud scan for a short report on lookalike domains and cloned pages within 48 hours.
FAQ
Is a cloned website always illegal?
Usually. Copying your content tends to infringe copyright, misleading use of your brand can infringe your trademark, and selling goods that never ship is fraud. Resellers, reviews and parody can be lawful, which is why each case needs a check. This is not legal advice.
Can I use copyright against a phishing page?
Often, if it copies your design, texts or logo. Phishing grounds are usually faster, so use copyright as a supporting argument.
What is a clone firm?
The FCA's term for fake firms that use the name, address and registration number of real authorized companies, typically in investment scams.
Do registrars take down fake shops?
Many do on solid fraud evidence. The ICANN obligation, however, covers phishing, malware, botnets, pharming and related spam, so for pure clones add fraud evidence and trademark grounds.
Sources
ICANN advisory: DNS abuse obligations, 5 February 2024
FCA: warning over clone firm investment scams, 27 January 2021