In the company I work for, we have many clients and the vast majority of them have hosting with us and we make their web apps. One client, though, just applied for cyber security. Our CEH (certified ethical hacker) asked me to make an exact replica of the client's login site to test phishing on their cloud service. All legal by contract.
I asked this same question in the wrong community where Giacomo1968 steered me in the right direction. So to be clear: The reason for the following is we had to prove to our client that their cloud login site can be replicated and published to a very similar domain, which is used for stealing login data.
I made the replica (down to a pixel), and backend that stores username and password (plaintext) to a database and sends an email to our CEH with the phished data.
So far, so good, but during the development process (last hour or two) a refreshed and reloaded both original and replicated pages several times.
Then when I was already finished, I refreshed the original site one last time (for no reason at all), and Google Chrome sent out a known alert:
This got me worried that Google might tag our company IP as malicious, resulting in many problems for our other clients who have their websites reachable at our IP address.
I have HTML markup linked with some CSS and JS and in the JS I use Fetch API to call a PHP script which in turn stores username-password combination to database along with
NOW() and then send an email with PHPMailer.
Should the phishing site have some tags or something which tell Google it's a cyber-security test or perhaps I'm going about the wrong way entirely. Or, hopefully not, there is just no chance and one should never put such code on server. If so, how do you test this locally if intended users can't browse there?