Sample Phishing Site: What a Fake Login Page Looks Like

A sample phishing site is a fake web page built to look like a bank, retailer, email provider or workplace login, so you type your credentials into it. The page itself is often a near-perfect copy. The clues are usually in the address bar, in how you arrived, and in what the page asks you to do. This guide walks through illustrative examples, the warning signs to check, how to practice safely, and what to do if you already entered something.

TL;DR

• A phishing site can copy the branding, layout and user experience of the real one, and the domain may be the only visible clue, according to Netcraft.
• Check the domain first, then how you got there. An unsolicited link plus an unfamiliar domain is enough reason to close the tab.
• Urgent, fear-based language and requests for personal or financial details are the classic warning signs listed by CISA. Bad grammar is no longer a reliable one.
• A password manager will not autofill on a domain it does not recognize, which turns a fake page into an obvious red flag.
• If you entered data, change the password, turn on multi-factor authentication (MFA), call your bank if money is involved, and report it to the FBI’s IC3.

What a sample phishing site looks like

Picture an email that says your streaming account is on hold. You click the button and land on a page with the right logo, the right colors, a familiar sign-in box and a footer with the usual links. Nothing looks off. That is the point.

The U.S. Department of Health and Human Services reports that thousands of fraudulent websites are built every day to collect information, sell products that do not exist, or push malware, and that fake login pages mirror the branding and templates of the legitimate ones. The same alert notes that bad actors sell premade fake login sites on the dark web, so a scammer does not need design skill. They need a few dollars and a domain name.

Netcraft’s analysis of real phishing pages makes a similar point: modern phishing kits can replicate an organization’s branding and experience so accurately that even security-conscious users may struggle to tell the difference. Some attackers do not even bother with code. Netskope observed codeless phishing pages built on a website-builder platform, in some cases using a screenshot of the real homepage as the whole interface.

So do not expect a sloppy page. Expect a convincing one, and look elsewhere.

Four illustrative examples

The addresses below are invented for teaching. They use the patterns that phishing sites commonly rely on, and none is a real site. The pattern of misusing domains the organization does not own, such as extra words, subdomains, character swaps or free hosting, is described by Phishvoid.

The page that loads at each address could be pixel-identical to the real login. What differs is who owns the domain.

Example 1: the “your package is held” page

A text message says a delivery failed and asks you to pay a small redelivery fee. The link opens a page with the carrier’s logo and a payment form. The fee is tiny on purpose: the goal is your card number, not three dollars. Real carriers do not ask for card details through a link in an unexpected text.

Example 2: the workplace single sign-on clone

An email appears to come from IT: your mailbox is almost full, sign in to keep it. The link leads to a clone of your company’s sign-in page. After you type your password, it may bounce you to the real page so you think nothing happened. The trick is that the first attempt “failed” and the second worked, so you move on.

Example 3: the clone of a message you really received

You ordered something, got a genuine confirmation, and later receive a near-identical message saying the earlier one had a problem and a corrected link is inside. Attackers copy a real email and swap in a malicious link. Because the context is real, trust is high.

Example 4: the account-security alert

A page warns that someone signed in to your account from another country and asks you to confirm your identity right now. It wants your password, a one-time code, and sometimes your card details. Fear and speed are the engine. Slow down and open the service by typing its address yourself.

Warning signs on the page and in the message

No single sign proves a page is fake, but several together are a strong case. Work through these in order.

1. Look at the domain, not the page

Read the address from right to left, up to the first single slash. The part just before the final extension, and the word to its left, is the domain that matters. The Texas Office of the Attorney General advises inspecting URL structure for subtle misspellings, unexpected character strings and extra characters at the end of the web address.

On a phone, the address bar may truncate. Press and hold a link to preview the full address before opening it.

2. Ask how you got there

Did you type the address, use a bookmark, or tap a link someone sent you? An unsolicited link is the common thread in nearly every example above. Phishvoid’s checklist asks whether you arrived through an unsolicited link, whether the owning domain is wrong, and whether the domain was recently registered.

3. Notice the emotional push

CISA identifies urgent, emotionally charged or fear-based language as a primary indicator, especially when a message claims dire consequences if you do not act. Other signs from the same guidance include requests for personal or financial information, untrusted shortened URLs, and wrong email addresses or links.

CISA also notes that poor grammar is less reliable than it used to be, because AI can produce flawless text. NIST makes the related point that increasingly capable AI can be used to craft convincing attacks, so it recommends taking a second or third look at requests for action.

4. Check what the page asks for

A login page asks for a login. If it also wants your Social Security number, full card details with the security code, or your email password to “verify” another account, stop. Payment pages that appear after a login you never started are another flag.

5. Verify through a channel you control

NIST advises verifying unsolicited requests by using contact details from the company’s public website, not the details inside the suspicious message. In practice: close the message, open a fresh tab, type the company’s address, and sign in there. If the alert was real, it will also be waiting in your account.

How to tell a fake login from a real one in ten seconds

Use this quick routine whenever a link asks you to sign in or pay.

1. Pause before clicking. Ask whether you expected this message.
2. Read the full domain. Find the registered domain and compare it letter by letter with the one you know.
3. Check the source. Did the link come from an email, text or ad you did not ask for? If so, do not sign in through it.
4. Go around the link. Type the address or use a bookmark.
5. Let your tools weigh in. If your password manager does not offer to fill your saved login, that is information. Treat it as a warning, not an inconvenience.

That last point matters more than it seems. Password managers match logins to the exact domain they were saved for, so they will not automatically fill credentials on an unrecognized look-alike. A human can be fooled by paypa1. A matching rule cannot. Our guide to password manager tips covers how to get the most from this behavior, and our piece on how secure password managers are explains the protections behind it.

If you have turned off autofill in your browser for other reasons, this support article explains how the built-in manager and a dedicated one can coexist without conflicts.

Perspective: why the domain check should not rest on you alone

We build password and identity tools, so we see the same story again and again: the person who fell for a phishing page was not careless. The page was good, the message arrived at a busy moment, and the address looked right at a glance.

That is why we do not think the answer is to ask everyone to be more vigilant all the time. Vigilance runs out. Our approach is to put checks in places that do not get tired. A password manager that fills credentials only on the domain you saved them for. Passwordless MFA, which is designed to reduce how much a stolen password is worth in the first place. Dark web monitoring, which is designed to alert you when your details show up where they should not.

None of this replaces looking at the address bar. It means a single slip does not have to become a breach. If you take one habit from this article, make it this: let the tool refuse to fill, and treat the refusal as a signal to stop.

Mike

Using phishing examples and simulations safely

If you are an IT lead, teacher or manager, you may want a sample phishing site to train people. Do it in a way that builds trust.

The Centre for Cybersecurity’s playbook recommends prior organizational notice, written agreement from the owner of the mail system covering sending, allow-listing and dates, a privacy review, and invented, fair lures. It also advises recording only the outcomes you need, never passwords or form text, reporting aggregate results, showing an immediate non-blaming learning page, making reporting easy, and not punishing people for clicking. It suggests announcing that the programme exists and explaining its purpose without revealing dates or lure details.

The UK National Cyber Security Centre adds a reality check: simulations cannot teach users to spot every phishing attempt. It recommends reassuring staff that they will not get in trouble for reporting suspected phishing, and warns that asking people to scrutinize every email can be unrealistic and counterproductive. Blame discourages reporting, while a positive security culture encourages it. Resilience needs technology, process and people together.

A few practical rules follow:

• Use invented brands or your own. Never clone a real company’s login for training without permission.
• Never capture real passwords. Log that someone submitted the form, not what they typed.
• Teach on the landing page. The moment after a click is when the lesson sticks. Show the clue they missed.
• Measure reporting, not just clicking. A rising report rate is a better sign of health than a falling click rate.
• Keep a simple reporting path. One button or one address, no forms.

For researchers, documented real-world data exists too. The Piracema repository holds 942,471 phishing records from 2016 to 2021, 135,542 of which preserve page source code. Its authors note that phishing databases can be disorganized, inconsistent and limited in balance, and that phishing is volatile: pages vanish quickly, so old snapshots matter.

If you already entered information on a suspicious site

Act in this order, and do not wait to be sure.

1. Change the password for that account, and for any other account that used the same one. Reuse turns one leak into many, as we explain in password reuse: convenient, but dangerous. Use a new, unique password from a generator.
2. Turn on MFA for the account. HHS recommends MFA because it can stop credential-stuffing attacks from getting into an account whose login details were exposed. Our page on passwordless MFA shows one way to set it up.
3. Call your bank or card issuer if you typed payment details. CISA’s example describes a victim whose stolen password and credit card were used for purchases, and who recovered most of his losses after contacting his bank and the retailer.
4. Report it. HHS notes that fake websites, emails, malware and other internet scams can be reported to the FBI’s Internet Crime Complaint Center (IC3). At work, tell your IT or security team right away. A fast report protects colleagues who got the same message.
5. Do not click anything else. If you only suspect a message and have not engaged, CISA’s guidance is to avoid links and attachments and delete it.

If your email address or password was involved, it is worth checking whether it has appeared in known leaks. Our identity theft protection and dark web scan page describes how monitoring works.

Where a password manager and MFA fit

Three layers cover most of the ground phishing pages try to exploit.

• Unique passwords per site. If a fake page steals one, it opens one door. See our write-up on warning signs of weak passwords.
• Domain-matched autofill. Saved logins appear only on the right site. Whether browser-saved passwords are enough is a fair question, and we look at it in is it safe to save passwords in Chrome or Safari.
• A second factor. Even when a password leaks, a second factor makes it harder to use. Passwordless sign-in goes further by removing the password as the thing to steal.

No tool makes anyone invincible, and we do not claim ours does. They narrow the damage a single mistake can do. For a deeper look at the question, read are password managers unhackable.

Choosing a plan that matches your risk

If you want these protections in one place, LogMeOnce offers plans for individuals, families and organizations.

For personal use, the Premium plan is listed at $0.00 per month, Professional at $2.50 per month, Ultimate at $3.25 per month and Family at $4.99 per month on our password manager page. Dark Web Monitoring is listed at $1.67 per month, and Family Dark Web Monitoring at $3.34 per month, alongside a Personal plan at $4.00 per month on the pricing and comparison page.

For workplaces, Teams is $4.00 per user per month and Business is $7.99 per user per month, with Enterprise available on request, all on the business pricing page. Managed service providers and government teams can see the full product range on our resources page.

Start with the free Premium plan if you want to see domain-matched autofill in action, or compare the tiers if you manage a team.

FAQ

Is it legal to build a sample phishing site for training?

It depends on what you copy and who you send it to. Using invented brands or your own organization, with written agreement from whoever owns the mail system, is the approach recommended in the Centre for Cybersecurity’s playbook. Cloning a real company’s login or collecting real passwords creates legal and privacy risk, so involve your legal or compliance team first.

Does a padlock icon mean a site is safe?

No. The padlock only means the connection is encrypted, not that the site belongs to who it claims to be. A fake page can be encrypted too. Check the domain and how you arrived instead, as the Texas Attorney General’s guidance suggests by inspecting the URL itself.

Can I be harmed just by opening a phishing page?

Opening a page is far less risky than submitting a form or downloading a file, but some fraudulent sites aim to deliver malware, as HHS notes. Close the tab, do not download anything, and run a security scan if you are unsure. If you entered credentials, follow the steps above.

Where can I report a phishing website?

In the U.S., you can report fake websites and scams to the FBI’s Internet Crime Complaint Center, as HHS notes. If it impersonates your employer or a service you use, also tell that organization’s security or support team.

Sources

• 10 Real Phishing Websites (Screenshots Included)
• Threats from Fraudulent Websites, HHS sector alert
• Attackers Target Crypto Wallets Using Codeless Webflow Phishing Pages
• Recognize and Report Phishing, CISA
• How to Spot and Report Internet and Email Scams, Texas Office of the Attorney General
• Phishing Site Examples: 8 Fake Pages and How to Spot Them
• Phishing, NIST
• How to run a fair phishing simulation, Centre for Cybersecurity
• Phishing attacks: defending your organisation, NCSC
• Piracema: a Phishing snapshot database for building dataset, Scientific Reports