⚠ Simulation Only: This page is a simulated clone. No credentials are transmitted or stored anywhere.
🔐 Critical Fake Login Page

Credential Harvesting

Attackers clone legitimate login pages pixel-for-pixel to steal usernames and passwords. The page looks identical — but your credentials go straight to the attacker.

1
The Bait
2
The Reveal
3
The Defence

🎣 Phase 1 — The Bait

You clicked a link in an email. This is the page you landed on. Try entering credentials — see what happens. No real data is sent.

🔒 accounts.g00gle-secure-signin.com/signin/v2/identifier

🔍 Phase 2 — The Reveal

That login page was a fake. Here's how to catch it. The URL is the most critical clue.

URL Dissection

✓ Legitimate
https://accounts.google.com/signin
✗ Phishing
https://accounts.g00gle-secure-signin.com/signin/v2/identifier
🚩
1. The Domain Is Not google.com
The real domain here is g00gle-secure-signin.com — "google" is misspelled with zeros. Google.com is never the domain here; it's just a subdomain-style trick. Any login page NOT hosted on google.com is fake.
🚩
2. The Padlock Doesn't Mean Safe
Notice the 🔒 in the address bar? The padlock only means the connection is encrypted — it does NOT mean the site is legitimate. Attackers easily get SSL certificates for their fake domains.
🚩
3. Password Field on First Screen
Real Google login asks for email first, then password on the next page. This page asks for both at once — a common shortcut attackers use that reveals the page is not the real Google flow.
🚩
4. No "Create Account" / "Use Without Account" Options
Legitimate Google login always has additional options like "Create account" and "Guest mode." Missing UI elements reveal an incomplete clone.
🚩
5. You Were Redirected From an Email
You should never sign into Google by clicking a link in an email. Always navigate directly to google.com yourself, or use a saved bookmark.

🛡️ Phase 3 — How to Defend Against Credential Harvesting

  • Always check the full URL in the address bar. The domain (e.g. google.com) must exactly match the expected service.
  • A padlock icon only means encrypted connection — not that the site is safe or legitimate.
  • Bookmark important login pages (banking, email, work tools) and access them only via bookmarks.
  • Enable two-factor authentication (2FA/MFA). Even if attackers capture your password, they can't login without your second factor.
  • Use a password manager — it will NOT autofill on fake domains, acting as a built-in safety check.
  • Never follow login links from emails or SMS. Navigate to the site yourself.
  • Enable Google's Advanced Protection Programme or equivalent for high-value accounts.
💡
Pro Tip: Password Managers Are Your Best Defence
A password manager (1Password, Bitwarden, etc.) stores credentials per domain. It will refuse to autofill on a cloned or look-alike domain — stopping credential harvesting automatically, even if you don't notice the URL.