How I Accidentally Stepped on a Phishing Site and Then Helped Shut It Down
A search result one position below the real thing took me to a login page that looked exactly right. I noticed a detail that was almost right, and the next four hours turned into a reporting exercise that took the whole operation offline.
Benjamin Fazli
Principal EngineerSkopje, North Macedonia
How it started
I searched for a service I use weekly, clicked the second result without reading it properly, and landed on a login page that was pixel accurate. Same layout, same typeface, same illustration, a valid certificate and a padlock in the address bar.
What stopped me was the domain. The real service uses a hyphen in its name. This one used an en dash, which is a character that renders almost identically in the browser address bar at normal font sizes and is a completely different domain.
I had already typed my email address. I had not yet typed the password, which is the only reason this is a story about reporting rather than about recovery.
What made it convincing
Working through it in a container afterwards, the quality of the thing was the interesting part:
- A genuine certificate from a free authority, so every browser trust indicator looked correct.
- A live reverse proxy to the real service, so the page was not a static copy. It reflected real content, which is why nothing looked stale.
- Real time credential relay. Submitting a form would have logged you in successfully, because it was forwarding your session while capturing it.
- Working two factor interception. The proxy passed the prompt through and captured the resulting session cookie, which is exactly why an authenticator app is not a complete defence against this pattern.
That last point is the one worth repeating. Time based codes do not protect you from a proxy that sits in the middle and forwards them.
Reporting it
Four reports, in the order that turned out to matter:
- The certificate authority. Fastest response by a wide margin, and revocation broke the padlock, which broke the illusion.
- The hosting provider. Found through a public address lookup. Their abuse address responded within the day and suspended the origin.
- The registrar. Slowest of the four, but the report is what eventually removed the domain rather than just the server behind it.
- The impersonated company. They already had a takedown process, and they were able to invalidate sessions for the accounts that had been captured.
The site was unreachable in under six hours. The domain was gone in nine days. Screenshots, the full URL, and request headers went into every report, because an abuse desk with evidence acts far faster than one being asked to investigate.
What I changed afterwards
- A password manager fills credentials by exact domain and stays silent otherwise. That silence is a better warning than anything on the page.
- Passkeys and hardware keys are bound to the origin, so a lookalike domain cannot complete the ceremony. Where they were available, I turned them on.
- I stopped clicking search results for login pages. Bookmarks for anything holding money or infrastructure access.
The padlock means the connection is encrypted. It has never meant the site is who it claims to be, and an attacker with a valid certificate is relying on you to conflate the two.