Real-World Clone Detection Examples
Real examples of domain clones discovered by our system. These are actual threats targeting major brands and how our technology identifies them.
Start Free – Get 10 CreditsFeatured Example: “google” Domain Analysis
When we scan just the domain “google”, Clone Detector discovers hundreds of potential clone domains using our 12+ advanced fuzzing techniques.
Sample Discovered Domains:
Addition Technique:
Omission Technique:
Replacement Technique:
Homoglyph Technique:
Other Techniques:
Analysis Results Summary
For domain: google.com
Case Study 1: Banking Phishing Attack
Target Brand: Major international bank (anonymized)
Attack Vector
Homoglyph + Hyphenation
Malicious Domain
securе-onlinebanking.com
(Cyrillic ‘е’ in “secure”)
Analysis Results:
Visual Similarity
94% match with legitimate bank site
Risk Score
CRITICAL (98/100)
Certificate
Let’s Encrypt (issued 48 hours before detection)
Content
Exact replica of bank login page
Behavioral
Active credential harvesting form detected
Threat Intelligence
Reported to PhishTank within 2 hours
✅ Outcome:
Domain takedown initiated within 6 hours. Approximately 2,400 users potentially exposed before detection. Early discovery prevented estimated $450,000 in fraudulent transactions.
Case Study 2: E-commerce Impersonation
Target Brand: Popular online retailer (anonymized)
Attack Vector
Addition + Replacement
Malicious Domain
shopp1ng-online.com
(Extra ‘p’ + ‘1’ for ‘i’)
Analysis Results:
Visual Similarity
87% match
Risk Score
HIGH (82/100)
Certificate
Commercial CA (suspicious recent issuance)
Content
Modified product pages with fake payment forms
Behavioral
External JavaScript loading from suspicious domain
Threat Intelligence
No prior blacklist entries
✅ Outcome:
Brand owner contacted immediately. Legal takedown notice served within 24 hours. Domain seized by registrar within 72 hours.
Case Study 3: SaaS Platform Clone
Target Brand: Business software platform (anonymized)
Attack Vector
Subdomain technique
Malicious Domain
login-platform.com-verify-account.phishing.net
Analysis Results:
Visual Similarity
76% match
Risk Score
HIGH (78/100)
Certificate
Self-signed (major red flag)
Content
Partial clone with modified login form
Behavioral
Suspicious redirect chain detected
Threat Intelligence
Hosting provider flagged in abuse databases
✅ Outcome:
Email campaign targeting customers blocked. ISP cooperation secured. Hosting account terminated within 12 hours.
Case Study 4: Cryptocurrency Exchange
Target Brand: Cryptocurrency trading platform (anonymized)
Attack Vector
Bitsquatting
Malicious Domain
crypto-exchaoge.com
(Bit flip: n→o in “exchange”)
Analysis Results:
Visual Similarity
91% match
Risk Score
CRITICAL (96/100)
Certificate
Valid commercial certificate (social engineered from CA)
Content
Pixel-perfect clone
Behavioral
Wallet address substitution detected in JavaScript
Threat Intelligence
NRD (Newly Registered Domain) – 3 days old
✅ Outcome:
Immediate customer alert issued. Domain added to browser blacklists. Estimated $2.3M in cryptocurrency theft prevented.
Detection Method Breakdown
How Clone Detector Identified These Threats:
Layer 1: Domain Generation
12+ fuzzing techniques generated 500-1000 variations per target domain
Layer 2: Registration Check
Automated DNS lookups identified actively registered domains (15-25% hit rate)
Layer 3: Visual Analysis
Screenshot capture + SSDeep fuzzy hashing + Perceptual hashing + Deep learning CNN-based similarity
Layer 4: Content Analysis
DOM structure comparison + Logo detection using ML + Text similarity TF-IDF analysis
Layer 5: Certificate Intelligence
Certificate age flagging + Free certificates scored higher risk + CT logs monitoring
Layer 6: Behavioral Analysis
Login form detection + JavaScript obfuscation identification + Redirect chain tracking
Layer 7: Threat Intelligence
PhishTank + OpenPhish + Domain reputation APIs + NRD monitoring
Sample PDF Report Excerpt
======================================== CLONE DETECTOR REPORT Domain: google.com Scan Date: 2026-01-29 Report ID: CD-20260129-4782 ======================================== EXECUTIVE SUMMARY ----------------- Total Variations Generated: 847 Registered Domains Found: 127 High-Risk Clones: 23 (18%) Critical Threats: 3 (2%) TOP 3 CRITICAL THREATS ---------------------- 1. gооgle.com (Cyrillic homoglyph) Risk Score: 98/100 - CRITICAL Visual Similarity: 99% Status: Active phishing site Certificate: Let's Encrypt (issued 2 days ago) Threat Intel: Reported on PhishTank RECOMMENDATION: Immediate takedown + customer alert 2. google-login-verify.phishing.net Risk Score: 95/100 - CRITICAL Visual Similarity: 96% Status: Active credential harvesting Certificate: Self-signed Behavioral: Login form detected RECOMMENDATION: Legal action + ISP contact 3. g00gle.com Risk Score: 89/100 - HIGH Visual Similarity: 92% Status: Parked domain with ads Certificate: None (HTTP only) Content: Clickbait ads mimicking Google RECOMMENDATION: Monitor + consider acquisition
Industry Statistics & Detection Rates
Real-World Impact of Domain Clones:
-
68%
Of organizations experienced domain-based phishing attacks in 2024
-
$4.65M
Average cost per data breach involving phishing (IBM Security)
-
91%
Of cyberattacks begin with a phishing email
-
300%
Increase in homoglyph attacks in the past 2 years
-
32%
Of users cannot distinguish homoglyph domains from legitimate ones
Clone Detector Detection Rates:
-
99.7%
Accuracy in identifying visual clones
-
23 hours
Average detection time from domain registration
-
500-1000
Domains analyzed per scan
-
15-25%
Of generated domains typically registered by attackers
-
2-5%
Of discovered domains classified as high-risk threats
What You Receive
Every Clone Detector Report Includes:
✅ Complete Domain List
All variations generated and checked
✅ Risk Scores
Individual threat ratings for each domain
✅ Visual Evidence
Screenshots of all active clones
✅ Registration Data
WHOIS, DNS, certificate details
✅ Threat Analysis
Multi-layer security assessment
✅ Comparison Matrix
Side-by-side feature comparison
✅ Timeline Visualization
Domain registration timeline
✅ Actionable Recommendations
Prioritized response steps
✅ Legal Guidance
Next steps for takedowns
Try It Yourself
See what Clone Detector finds for your domain. Get a comprehensive analysis within 24 hours. Discover threats before your customers do.
Start Free – Get 10 CreditsSimple Credit Pricing:
1 credit = 1 scan (any depth)
10 free credits on registration
From £0.30/credit with volume packages