# PhishClone: Measuring the Efficacy of Cloning Evasion Attacks

arXiv: https://arxiv.org/abs/2209.01582 · HTML: https://mlsanity.com/paper/2209.01582/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 10 of its 44 references that are in the map.
- First posted on arXiv 4 Sep 2022.

## Builds on (most cited first, 10 of 10)

- [URLNet: Learning a URL Representation with Deep Learning for Malicious URL Detection](https://mlsanity.com/paper/1802.03162/) (2018)
- [Advanced Evasion Attacks and Mitigations on Practical ML-Based Phishing Website Classifiers](https://mlsanity.com/paper/2004.06954/) (2020)
- [DeltaPhish: Detecting Phishing Webpages in Compromised Websites](https://mlsanity.com/paper/1707.00317/) (2017)
- [RAIDER: Reinforcement-aided Spear Phishing Detector](https://mlsanity.com/paper/2105.07582/) (2021)
- [Towards Web Phishing Detection Limitations and Mitigation](https://mlsanity.com/paper/2204.00985/) (2022)
- [Characterizing Malicious URL Campaigns](https://mlsanity.com/paper/2108.12726/) (2021)
- [DeepCapture: Image Spam Detection Using Deep Learning and Data Augmentation](https://mlsanity.com/paper/2006.08885/) (2020)
- [Email Summarization to Assist Users in Phishing Identification](https://mlsanity.com/paper/2203.13380/) (2022)
- [Scam Pandemic: How Attackers Exploit Public Fear through Phishing](https://mlsanity.com/paper/2103.12843/) (2021)
- [Profiler: Profile-Based Model to Detect Phishing Emails](https://mlsanity.com/paper/2208.08745/) (2022)

## Built on by (most cited first, 1 of 1)

- [DisCTI: Who Needs to Know Timely? Automated Sector-Aware Cyber Threat Intelligence Dissemination](https://mlsanity.com/paper/2608.27967/) (2026)

## Abstract (arXiv)

Web-based phishing accounts for over 90% of data breaches, and most web-browsers and security vendors rely on machine-learning (ML) models as mitigation. Despite this, links posted regularly on anti-phishing aggregators such as PhishTank and VirusTotal are shown to easily bypass existing detectors. Prior art suggests that automated website cloning, with light mutations, is gaining traction with attackers. This has limited exposure in current literature and leads to sub-optimal ML-based countermeasures. The work herein conducts the first empirical study that compiles and evaluates a variety of state-of-the-art cloning techniques in wide circulation. We collected 13,394 samples and found 8,566 confirmed phishing pages targeting 4 popular websites using 7 distinct cloning mechanisms. These samples were replicated with malicious code removed within a controlled platform fortified with precautions that prevent accidental access. We then reported our sites to VirusTotal and other platforms, with regular polling of results for 7 days, to ascertain the efficacy of each cloning technique. Results show that no security vendor detected our clones, proving the urgent need for more effective detectors. Finally, we posit 4 recommendations to aid web developers and ML-based defences to alleviate the risks of cloning attacks.