Malte ZanderContents
A cloned login page usually gives itself away before the first victim types a password. Look for four signals: a new domain with your name, a fresh TLS certificate in public logs, an unknown site loading your logo or scripts, and the first confused customer. Confirm the clone against your real page, then report it the same day.
- Chrome requires all publicly trusted TLS certificates to be logged in Certificate Transparency logs, so certificates for fake login domains show up in public records (Chrome).
- Logins are the prime target: in the fourth quarter of 2025, social media and SaaS or webmail brands were the most attacked sectors, with 20.3% each (APWG).
- In July 2025, Okta found AI-generated replicas of sign-in pages for several brands, including one Okta customer (Okta).
How do criminals clone a login page?
They copy what people recognize and change what they cannot see. The logo, layout, texts and colors stay; the form now sends usernames and passwords to the attacker.
Three variants are common:
Static copy: a saved or AI-generated version of your page on a lookalike domain or a hacked website.
Real-time proxy: the attacker relays your real login page and captures passwords, codes and session cookies on the way. Microsoft tracked one such campaign against more than 10,000 organizations (Microsoft). Read why two-factor login doesn't stop every phishing page.
Cloaked copy: the fake only appears for targets, for example with the right parameters in the link or from certain countries. Everyone else sees a harmless page. See hidden fakes.
Which signals reveal a cloned login page early?
Every clone has to leave traces in public infrastructure or in your own systems before it can work. The earlier the signal, the less proof it gives, so combine them.
| Signal | Where you see it | When it appears | What it tells you |
|---|---|---|---|
| New lookalike domain | Registration data, domain scans | Often days before launch | Intent, not yet proof |
| New TLS certificate for a lookalike name | Certificate Transparency logs | Around issuance, often before the campaign | The site is about to go live |
| Your files loaded by an unknown site | Web server or CDN logs, referrer data | When the clone is tested or live | A copy exists and still points at you |
| Unusual sign-ins | Identity provider logs | When stolen data is used | Credentials are already in use |
| Reports from customers or staff | Support inbox, social media, report form | With the first victims | A live campaign, and often the full link |
| Ads and search results with your name | Search engines, ad libraries | During distribution | How people reach the clone |
In proxy attacks, the sign-in logs are the most telling signal. Microsoft recommends hunting for sign-ins with unusual locations, ISPs or user agents and for suspicious inbox rules after a sign-in (Microsoft).
How do you check whether a suspicious page copies yours?
You compare it with your real page and look behind the surface, without ever entering data:
Compare the look on desktop and mobile: logo, layout, wording, colors, form fields.
Read the address: domain, subdomains and path. Your brand name in front of a foreign domain is a classic trick.
Check the certificate: issuer, issue date and other names on the same certificate. Our guide on reading SSL certificates explains what they reveal.
Look at the page source: where the form sends its data and whether images or scripts still load from your servers.
Check age and hosting: a domain registered last week on a budget host is a strong signal in context.
HTTPS proves nothing here. The padlock means the connection is encrypted, not that the site belongs to you.
How do you set up monitoring for your login pages?
Start with a short list of what attackers would copy, then watch each signal on a schedule.
List your login surfaces: customer login, partner portal, single sign-on, password reset and MFA enrollment pages.
Watch domain variants: typos, lookalike characters, add-ons like login, secure or verify, and other extensions. See lookalike domains.
Search Certificate Transparency logs for your brand terms, daily for high-value logins.
Alert on unknown referrers that load your logo, fonts or scripts. A unique image on the login page makes copies easy to spot in logs.
Hunt in sign-in logs for proxied sessions and new hosting IP ranges.
Make reporting easy: add a visible way to report a suspicious link on the login and help pages.
What do you do once you find a clone?
Act the same day, because a live clone collects credentials every hour it stays online.
Secure evidence: full URL, screenshots, certificate, hosting and DNS data.
Report in parallel to host, registrar, Google Safe Browsing and Microsoft. Registrars of generic domains must act promptly on actionable evidence such as a screenshot and the complete URL (ICANN).
Protect accounts: block the domain in your email and web filters, check sign-ins from the clone's infrastructure and reset affected credentials and sessions.
Warn customers if they are targeted. Our guide on warning customers without causing panic includes a template.
Keep watching, because clones return on new domains.
The full sequence with owners is in our 24-hour response plan.
Start the free fraud scan: we check your brand for lookalike domains and cloned login, website and verification pages and email you a short report within 48 hours.
FAQ
Does HTTPS mean a login page is genuine?
No. HTTPS only encrypts the connection. Phishing sites get TLS certificates as easily as real ones, which is also why Certificate Transparency logs are useful for finding them.
Can I stop criminals from copying my login page?
Not completely, because anything a browser can display can be copied. You can make copies easier to detect, for example through referrer alerts, and less useful by moving to phishing-resistant login methods.
How often should I check for cloned login pages?
At least weekly, and daily for logins that open payments, personal data or admin rights. The earlier you see a new domain or certificate, the more time you have.
Can I find out who built the clone?
Rarely by name, because registration data is often redacted. Hosting, certificates and shared code still link cases, which helps hosts, registrars and investigators act.
Sources
APWG Phishing Activity Trends Report, Q4 2025, published 18 February 2026
Okta Threat Intelligence: v0 AI tool used to build phishing sites, 1 July 2025
Microsoft Security: AiTM phishing sites as entry point to financial fraud, 12 July 2022
ICANN advisory: DNS abuse obligations, 5 February 2024