Phishing and clone sites: capturing the evidence before the page disappears
A message arrives that looks like it came from a bank, a courier or a familiar marketplace. The link opens a page that mirrors the real one and asks for credentials or card details. Phishing and spoofing were the most reported crime category in the FBI's 2025 Internet Crime Report, with 191,561 complaints out of more than a million filed that year, and reported phishing losses grew more than threefold to 215.8 million dollars.
The hard part is rarely understanding what happened. It is proving it. A fraudulent page has an extremely short life: a study presented at the ACM Web Conference 2025, based on 286,237 unique phishing addresses, measured a median lifespan of 5.46 hours. By the time the victim calls the bank, files a report or instructs a lawyer, the address returns an error and one artefact survives the whole episode: a hurried screenshot taken on a phone, which the other side can dispute because nobody can verify what it actually showed.
That leaves one question worth answering: how do you obtain proof that still holds once the site is gone? The proof has to be built while the page is still live. What is needed is a forensic acquisition that fixes the content, the network address and the exact moment, closed by an electronic seal that makes any later alteration detectable. Do that in the first few minutes and you walk into the bank and the prosecutor's office with a complete technical file. Skip it and you walk in with a picture.
How long a phishing page actually stays online
The window for collecting evidence is measured in hours. That is not a cautious estimate, it is the median observed in the field, and it holds both for fake account login pages and for counterfeit stores copying a known retailer's brand.
The lifespan of a phishing site is short enough to make any deferred evidence collection unworkable. The study "7 Days Later: Analyzing Phishing-Site Lifespan After Detected", presented at the ACM Web Conference 2025 and based on 286,237 unique addresses tracked over five months, measured a median lifespan of 5.46 hours and a mean of 54 hours. Some 83.93 per cent of sites were already taken down before browser warning systems even detected them, and those systems in turn flag only 18.4 per cent of phishing sites, with an average delay of 4.5 days. Pages impersonating logistics operators are the most fleeting of all, with a median life of 1.76 hours. Anyone waiting for an automated system to confirm the fraud before documenting it will, in most cases, be documenting a page that no longer exists.
Volume turns this into a structural problem rather than an occasional one. The Anti-Phishing Working Group observed roughly 3.8 million phishing attacks across 2025, peaking at 1,130,393 attacks in the second quarter alone. Against that backdrop, the instinct to revisit the page "when there is time to deal with it" is simply mistaken. In most cases that time does not exist.
Why a hurried screenshot does not hold up
A screenshot taken on a phone is an image. Across most jurisdictions its evidentiary weight depends on whether the opposing party accepts that it faithfully represents what was on screen, and a challenge is usually enough to shift the burden and demote the exhibit to a claim that needs corroboration.
The practical obstacle sits underneath the legal one. Once the page is offline, neither party can verify anything, and a court has no way to establish whether the image matches what was served at that moment. International guidance on handling digital evidence, notably ISO/IEC 27037 on the identification, collection and preservation of digital evidence, is built around a simple premise: the value of the exhibit depends on how it was captured and on whether that process can be reconstructed afterwards. A phone screenshot documents none of that.
There is also a completeness problem that precedes authenticity altogether. A screenshot shows what the eye saw, not what matters technically: the full address including parameters, the server that responded, the certificates presented, the page source, the resources loaded from third parties. Those are exactly the details a bank asks for when opening a chargeback and the registrar demands when assessing a takedown request. Our guide on how to save a web page as evidence covers the mechanics in more depth.
| Element | Phone screenshot | Certified capture at source |
|---|---|---|
| Full page address | Partial or cropped | Recorded in full, parameters included |
| Responding server | Absent | Network resolution documented |
| Page source and loaded resources | Absent | Captured alongside the page |
| Moment of capture | Device clock, editable | Qualified time stamp, opposable to third parties |
| Later alterations | Not detectable | Detectable through the electronic seal |
| Verification by the recipient | Not possible | Independent, without relying on the sender |
| Survives the site being taken down | Disputable | Content remains documented |
What the capture of a clone site has to contain
A useful acquisition is not a photograph of a browser window. It is the documented record of a browsing session, including everything the server actually returned. Four elements separate a file that will be challenged from one that holds.
The address and the network resolution
The counterfeit domain is the foundation of both the criminal complaint and the takedown request. You need the full address, including the parameters that identify the fraudulent campaign, and the resolution to the server that answered at that moment. This is what allows separate pages to be tied back to the same infrastructure, and in cases of digital identity theft and cloned accounts it is often the only thread connecting episodes that look unrelated.
The page source and the loaded resources
The source contains what the image cannot show: where data entered into the form is sent, which third-party scripts are active, which images and logos were pulled from the legitimate site. For a brand owner that last detail is the proof of unauthorised use of the mark, and it supports an online brand protection action far more effectively than a screen capture ever will.
The moment the page was live
A smartphone's system clock can be changed in seconds and everyone knows it. For the moment of capture to be opposable, it needs a qualified time stamp issued by a third party, binding the captured content to a fixed instant. Under the eIDAS Regulation (EU) No 910/2014, a qualified electronic time stamp benefits from a presumption of accuracy of the date and time it indicates and of the integrity of the data it is linked to. That is what lets you state, months later, that the page was live at 21:14 on the day the transfer left the account.
The navigation chain
Fraud rarely lives on a single screen. There is the message, a first address redirecting to a second, the page asking for credentials and the one asking for the one-time code. Documenting the sequence rather than only the final step reconstructs the deception as a whole, and that is what makes the episode legible to someone reading about it rather than living through it. The applicable techniques are set out in our piece on making a forensic copy of a website.
What certification at source means for a fraudulent page
Certification at source is the acquisition of digital content at the very moment it exists, performed with a forensic methodology and closed by a seal that makes any subsequent alteration detectable. The principle inverts the usual approach: instead of trying to demonstrate after the fact that an image is genuine, the proof is built while the fact is still observable. TrueScreen applies that principle to fraudulent web pages. The platform captures the page while it is still live, collects the technical session data alongside the visible content, and integrates via API the electronic seal and qualified time stamp issued by a third-party qualified trust service provider. The output is not an image to attach: it is a document that the recipient, whether a bank's fraud desk or a prosecutor, can verify independently without having to trust whoever handed it over. It is Digital Provenance applied to content that is about to vanish.
Capture from the device that received the message
The fraud almost always lands on a phone, and that is where it should be documented. With the TrueScreen mobile app the suspicious page is captured directly on the device, with no intermediate transfer that would create another step to justify. Anyone working from a desk, a fraud analyst receiving a customer report for instance, runs the same process from the web platform.
Electronic seal and qualified time stamp
The captured content is then sealed. The electronic seal and the qualified time stamp are applied by a qualified trust service provider integrated into the platform, not generated in-house. From that point on, any change to the file, down to a single byte, becomes detectable at verification. That is the difference between asserting that content was untouched and being able to demonstrate it.
Independent verification by the recipient
Whoever receives the document does not have to take the sender's word for it, and can check its integrity independently. Organisations handling significant volumes of reports can trigger the capture from their own fraud system the moment a report arrives, through the platform's integration interfaces, with no manual step. The requirements a file has to meet to survive scrutiny are set out in our overview of court-ready digital evidence.
A recurring example: a bank's customer service receives a report about a fake account login page at 18:40. The analyst opens the address, captures and certifies it in under two minutes. By 23:00 the domain no longer responds. The next morning the legal team still has the page source, the address of the server harvesting credentials, and the time stamp that places the capture before the disputed transfers.
What to do in the first minutes after finding a clone site
The priority is not working out who is behind it, which is a common mistake. The priority is fixing the state of the digital scene while it still exists. The order of operations matters more than how carefully each one is performed.
- Do not close the browser tab and do not delete the message. The message that delivered the link is part of the evidence just as much as the page is.
- Capture and certify the page while it still responds, together with the path that led to it. If data was entered, document the confirmation screen too.
- Freeze the payment instruments involved and open the dispute with the payment service provider, attaching the certified document.
- File a report with law enforcement, attaching the acquisition. In most jurisdictions the conduct engages computer fraud and impersonation offences, and the technical file is what turns a narrative into a case.
- Report the domain to the registrar, the hosting provider and the imitated brand. A takedown request with a verifiable technical attachment is handled differently from a generic complaint.
The same method applies to every fraud that plays out on a page designed to disappear: fake investment portals, bait listings, forms impersonating a public authority. The operating rule does not change. Capture first, analyse afterwards.
Who uses this evidence and what for
The certified document serves several audiences, and each one uses a different part of it.
Fraud teams at banks and insurers use it to process reimbursements and to link episodes that look isolated: when twenty customers report different pages posting to the same server, the picture changes shape. Legal teams use it because it arrives complete with the technical details that would otherwise have to be reconstructed by an expert, assuming reconstruction is still possible. Brand owners hit by counterfeit stores use it to evidence unauthorised use of their mark and to support takedown requests with registrars and advertising platforms. Professionals and individuals who have been defrauded use it so they do not turn up to file a report holding the only thing they usually have, which is a photograph of a screen.
Across all of these, the decisive factor is not how sophisticated the tool is but when it gets used. Evidence collected with a forensic methodology while the page was live is worth as much as the page itself. Evidence collected afterwards is worth as much as the memory of whoever saw it.
