Customer portal clones work because they replicate trust: design, copy and navigation. Once the clone is live, the goal is typically to capture credentials and customer data during the first hours.
What happened
The site was published with a login page that closely matched the insurer's customer portal. The form fields forwarded credentials to attacker-controlled infrastructure, and collected policy numbers when available.
Response
After the alert, the team coordinated hosting notifications and blocked access via DNS/perimeter controls. The site remained live for a short time.
Key takeaways
- The impact window is short: early detection is decisive.
- Takedowns move faster with clear evidence and exact URLs.
- Combining clone monitoring with domain monitoring reduces recurrence.