What is a fake login page?¶
A fake login page is a website designed to imitate a genuine authentication page and capture information entered by the user.
Avoid the dangerous assumption¶
The dangerous assumption is that a page looking identical to a trusted service must belong to that service.
Visual appearance is easily copied.
A fake page may reproduce logos, wording, colours, error messages and even parts of the genuine sign-in process. The domain name, hosting and data destination are more important than appearance alone.
Some fake pages simply collect a username and password. Others may request multi-factor codes, payment details or personal information.
More advanced pages may relay the user’s authentication to the genuine service while capturing session material.
Preserve:
- the original link
- the domain and full URL
- screenshots or a safe technical capture
- page source where lawfully and safely obtained
- hosting and certificate information
- the time the page was live
- any submitted-data endpoint
- related phishing messages.
Do not enter real credentials to test the page.
Ask whether the user reached the page, what they entered and what happened afterwards. A page visit does not prove information was submitted. Submission does not automatically prove the offender received or used it.
The page may also have been hosted on a compromised legitimate website, a cloud service or disposable infrastructure. Hosting records may identify an account or service customer, but not necessarily the person operating the page.
Where the page is still live, preservation may be urgent because content can be changed or removed quickly.
Operational takeaway¶
Assess a suspected login page by its domain, hosting, behaviour and data destination, not its appearance, and preserve it before it changes or disappears.