Sees what scanners miss
Dual-profile crawling resolves the cloak that lets ordinary scanners wave a phishing page through.
How it works
From detected
to removed
Four stages, one panel, no manual stitching. Here is exactly how a clone goes from first sighting to confirmed offline — and why cloaking never gets in the way.
- 01
Detect
Phish Plug watches newly registered domains, certificate logs, lookalike and homoglyph patterns, backlinks and search results around the clock. Anything resembling your brand's name, marks or login flow is captured for verification — before your customers ever see it.
- 02
Crack the cloak
Cloaked phishing shows one page to crawlers and another to real visitors. Phish Plug fetches each suspect twice — as a search bot and as a real in-country mobile device through its proxy pool — and diffs the two responses to expose and prove the hidden redirect.
- 03
Capture evidence
The moment impersonation is confirmed, a case is built: screenshots from both crawl profiles, raw response headers, the cloaking diff and the resolved redirect chain. It is stored per case and exportable, designed to be accepted on first submission.
- 04
File the takedown
Each clone's host, registrar and CDN are resolved, and the report is formatted for the correct abuse desk. With one human approval it is sent across the right channels — then the case is tracked until the page is confirmed offline.
Step 2, up close
One URL. Two realities.
This is what cloaking looks like — and what Phish Plug compares, side by side, to prove the redirect that keeps a phishing page alive.
aurora-bonus.net/loginheritage-archiveARCHIVE · STORIES · ABOUT
ACCOUNT SERVICES
Your session has expired
Re-enter your details to restore access.
EMAILPASSWORD• • • • • • • •VERIFY ACCOUNT CLOAKED REDIRECT · 181.20.AURORA.COM Phish Plug crawls as both a search bot and a real in-country phone, then diffs the two responses to prove the redirect.
Why it works
Fast because it is precise
Evidence desks accept
The cloaking diff and raw headers turn a dismissible screenshot into a case that gets actioned — 99% accepted.
Routed, not blasted
Reports go to the exact desk for that host and registrar, which is why median time to filing is 37 minutes.
37min
Median time to filing
99%
Evidence accepted
6
Abuse channels
24+
Takedown desks
FAQ
How it works — in detail
How does Phish Plug find clones in the first place?
It continuously watches newly registered domains, certificate transparency logs, lookalike and homoglyph patterns, backlinks and search results. Anything that resembles your brand's name, marks or login flow is pulled in for verification.
What exactly is 'cracking the cloak'?
Cloaked phishing serves two pages from one URL. Phish Plug fetches each suspect twice — as a search crawler and as a real in-country mobile device — then diffs the responses. When the mobile version is a credential trap and the crawler version is clean, the hidden redirect is proven.
Why does a human approve each takedown?
Automation finds and prepares; a person decides. Requiring a one-click approval before anything is sent keeps accuracy high and guarantees a legitimate site is never reported by mistake. It is the difference between fast and reckless.
How are reports routed to the right desk?
Each clone's hosting, registrar and CDN are resolved automatically, and the report is formatted for — and sent to — the correct abuse desk for that infrastructure. The right evidence goes to the right place, which is why desks act quickly.
How do I know a clone is actually gone?
Every case carries a live Detected → Removed timeline. Phish Plug re-checks the target until it confirms the page is offline, then archives the case with its full evidence trail.
How long does the whole thing take?
Median time from detection to a filed, evidence-backed takedown is 37 minutes. Removal time then depends on the host, but routing the right evidence to the right desk is what keeps it short.
Watch it work on your brand
Run a free clone check and see detection, cloaking forensics and evidence in one pass.