Why do phishing sites use pictures of the full site (e.g., they took screenshot and broke it up) instead of just copying the real HTML and modifying the target for form submission of username/password?

It would seem a lot of people would notice that the text is not selectable or that interactive features do not work.

1 Answer 1


Using the real code from the website may increase the ability for automated detection to find and identify the phishing site. If the victim site has some specific text phrase, this could be used in searches across the web to identify potential phishing sites. Crawlers and other bots may also store complete HTML and could match against structural items. With images you do join all of the images and then do OCR, which would be very time consuming and hard to narrow down the list of potential sites imitating you.

Phishing site operators may also choose to cut up the screenshot images differently on each site and use different file names so that each site attacking the same victim is harder to identify.

Also, it may be possible to utilize CSS for the images and layout to further reduce the amount of available code and content to match against.

Remember, Phishers aren't trying to fool everyone. They less credible the site, they know the ones who fall for the scam are less likely to notice and report (Check out this Microsoft Research Report).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .