Fake login pages using your brand: how they appear and how to get them taken down

A fake login page is a copy of your sign-in screen hosted on a domain you do not control. It exists to collect usernames, passwords and sometimes one-time codes from your customers or employees, who arrive through an email, a text message, a search ad or a link in a chat.

If you run a customer portal, webmail, a SaaS product or anything with a login, your page can be copied in minutes, because the HTML, logo and styles are delivered to every visitor. What attackers need is a domain that looks believable and a way to get people to it.

You can spot many of these pages before they are widely used, and there is a clear set of places to report them so they get blocked and removed.

How fake login pages are set up

Most follow the same steps:

1. A domain. Usually a lookalike (examp1e.com, example-login.com) or a subdomain on an unrelated domain (example.com.secure-verify.net). See lookalike domains and typosquatting.
2. A certificate. Browsers show a padlock for any site with a valid certificate, so attackers obtain one for the domain. That certificate is recorded in Certificate Transparency logs.
3. A copy of your page. Often your own HTML with the form action changed to send credentials elsewhere. Some setups forward the credentials to your real site in real time, which can also capture one-time codes.
4. Distribution. Email, SMS, social media messages or paid ads pointing to the copy.

The first 2 steps leave traces that can be observed before many people see the page.

How to spot them early

Watch certificate issuance. Search Certificate Transparency logs for names containing your brand, for example on crt.sh with a query like %example%. A new certificate for example-account-check.com that you did not request is worth a look. Our article on Certificate Transparency logs explains what these logs show.

Watch new lookalike domains. Tools such as dnstwist list registered variants of your domain, and with the --lsh option compare their HTML to yours:

dnstwist --lsh https://example.com/login example.com

A high similarity score on a domain you do not own is a strong signal.

Listen to your users. Support tickets like "I logged in but nothing happened" or "your site asked for my code twice" are often the first sign. Give support a simple way to forward suspicious links to whoever handles security.

Check your own logs. Some copies load images, scripts or fonts directly from your site. Requests for your assets with a Referer header from an unknown domain can point you to the copy.

How to get a fake login page taken down

Work through these in parallel, not one after another:

1. Browser blocklists. Report the URL to Google Safe Browsing and to Microsoft. Once listed, major browsers show a warning before the page loads, which protects people even while the site is still online.
2. Anti-phishing community. The Anti-Phishing Working Group asks people to forward phishing emails to reportphishing@apwg.org.
3. The registrar. Find it with whois and use its abuse contact. ICANN-accredited registrars must publish an abuse contact and take reasonable and prompt steps to investigate abuse reports under section 3.18 of the 2013 Registrar Accreditation Agreement.
4. The hosting provider. Look up the IP with dig example-login.com +short, then find the network owner with whois <ip> and report to its abuse address.

A good report is short and verifiable: the exact URL, a screenshot, the time you saw it, your real domain, and a sentence explaining that the page imitates your login to collect credentials. Do not try to log in to the fake page or interact with it beyond what is needed to document it.

Limiting the harm

Takedowns take time, so reduce what a stolen password is worth:

• Offer and encourage phishing-resistant sign-in, such as passkeys or security keys, which are bound to your real domain and do not work on a copy.
• Watch for unusual logins after a phishing report: new locations, many accounts from one IP, or password resets in bulk.
• Tell users where you log in. A short notice ("we only ever ask you to sign in at example.com") helps.
• Enforce DMARC on your real domain so the emails leading to the copy cannot use your exact address. See SPF, DKIM and DMARC explained.
• Reset affected accounts and invalidate sessions for users who report entering their password.

Checklist

• Certificate Transparency search for your brand name, repeated on a schedule.
• Lookalike domain scan with page similarity.
• A support process for forwarding suspicious links.
• Report templates ready for Google, Microsoft, APWG, registrars and hosts.
• Phishing-resistant sign-in available to users.

How Datahorses helps

Datahorses watches your company from the outside every day for fake login pages on lookalike domains, newly issued certificates that use your name and known phishing reports that mention your brand. We do not enter your systems and need no access. When we find a page imitating your login, a person reviews it and you receive the details and the takedown steps, as described in what happens when we find something. You can see how such a finding looks in the example dashboard.