Know the moment someone clones your website. A tiny JavaScript snippet embedded in your pages alerts you when your site is copied to a malicious domain. Stop phishing attacks at the source.
A tiny JavaScript snippet that phones home when your page loads. If it loads from an unauthorized domain — you get alerted.
Add a small JavaScript snippet to your protected pages. It's invisible to users and adds no perceivable load time.
When someone copies your HTML to create a phishing site, they copy the snippet too — it's embedded in your page.
When the cloned page loads from an unauthorized domain, the snippet phones home and you get an immediate alert.
Phishing kits work by copying your HTML wholesale. That's their weakness — and your advantage.
The snippet is embedded in your page. Most phishing kits are automated and don't inspect every script.
The alert fires the moment the phishing page loads — before victims enter credentials.
Doesn't matter what tools the attacker uses — if they copy your page, they copy the tripwire.
<!DOCTYPE html>
<html>
<head>
<title>Login - YourCompany</title>
<!-- Tripwire Clone Detection -->
<script src="https://t.tripwires.io/abc123"></script>
</head>
<body>
...
</body>
</html>
Script size: ~500 bytes | Load time: <10ms
The canary only fires when your page loads on a hostname you haven't listed as legitimate. On your real domains it stays completely silent — zero false positives.
Add the domains where the page is genuinely served. Any other host is treated as a clone.
When it fires, the beacon carries the hostname the clone is running on plus the referrer that led there.
Loads from localhost are ignored, so building and testing your own pages never triggers an alert.
// List every host where these pages
// are LEGITIMATELY served:
var EXPECTED_HOSTS = [
'example.com',
'www.example.com'
];
// Any other host beacons home with
// the cloning domain + referrer:
if (!allowed(host)) {
new Image().src = beacon
+ '?cloned_host=' + host
+ '&ref=' + referrer;
}
Every detection provides actionable intelligence to take down phishing sites fast.
Full URL of the cloned page for takedown requests
IP address and hosting provider for abuse reports
Exact timestamp when the clone went live
How many times the phishing page has been loaded
Protect your brand and your customers. Know the moment your site is cloned.