Automated clone detection is reliable at establishing similarity and unreliable at every question that follows from it. Knowing which is which decides where a person has to sit in the workflow.
What each is good at
| Question | Automation | Person |
|---|---|---|
| Does this page resemble ours? | Reliable — hashes, structure, assets | — |
| Does it collect credentials? | Mostly — a form posting off-domain is detectable | Confirms |
| Is this a partner, a reseller or an archive? | Poor | Required |
| Is this a real business with a similar name? | Poor | Required |
| Is this our own marketing agency’s staging site? | Cannot know | Required |
| Is the page different for different visitors? | Frequently missed | Required |
Cloaking
Phishing sites routinely serve different content to different visitors: a benign page to datacentre address ranges and known scanners, the real page to a browser from a residential connection with the expected referrer.
- An automated check from a cloud address is exactly the traffic cloaking targets.
- A clean automated result on a strongly suspected domain should raise suspicion rather than close the finding.
- A person looking, from an ordinary browser, sees what a victim sees — which is why manual confirmation before reporting is not ceremony.
What the automation should hand over
Not a verdict. A package: the similarity evidence it found, the DNS and registration snapshot, the certificate details, and a rendered capture — so the person spends their time on the judgement rather than on the gathering.
A clean scan is not an all-clear
The most dangerous output of an automated checker is “no phishing content detected” on a domain with a lookalike name, a fresh certificate and an MX record. Every one of those signals survives cloaking, and the scan result is the one that does not.