Pro Feature
Backlink Impersonation Detection
Phishing pages do not always rely on a fake logo alone. Many of them borrow trust by linking out to real privacy pages, support centers, and brand assets. PhishClean catches that mismatch before the borrowed credibility does the damage.
What this feature watches for
📷
Hotlinked brand assets
Real logos, icons, and other media loaded from PayPal, Microsoft, Google, or similar domains to make a fake page feel official.
📄
Official-looking footer links
Privacy, terms, legal, cookie, and support links pointing to a real company from a page that is not actually on that company's domain.
🔗
Brand-domain mismatch
A page hosted on an unrelated domain that still leans heavily on one brand's resources while asking for credentials.
Why this signal matters
Many phishing pages now look polished enough that a quick visual check is not enough. Attackers know users feel safer when they see real privacy-policy links, real help-center URLs, and genuine logo files. Instead of inventing everything, they borrow the pieces that already carry trust.
That means the page can be fake even while some of its links are real. The suspicious part is not the PayPal privacy page itself. The suspicious part is a random domain leaning on PayPal assets and PayPal footer links while asking for a password.
Example: paypal-secure-verify.xyz shows a login box, loads a PayPal logo from a real PayPal asset domain, and adds a footer link to paypal.com/privacy.
Signal: unrelated page host + multiple PayPal backlinks + password field = high risk
How PhishClean evaluates the page
1
Collect outbound references. PhishClean looks at links, images, scripts, stylesheets, iframes, and form actions already present in the page.
2
Match trusted brand domains. If those references point to known PayPal, Microsoft, Google, Amazon, Apple, or similar brand domains, the page gets a brand-borrowing signal.
3
Compare against the current host. A real PayPal page linking to PayPal resources is normal. An unrelated host linking to several PayPal resources is not.
4
Combine with context. Password fields, hotlinked brand assets, policy links, and a dominant borrowed brand raise the final risk score.
Why this stays practical instead of noisy
Not every page that links to Google or Microsoft is malicious. Blogs, docs, and support articles do that all the time. PhishClean does not treat a single brand link as enough on its own. The signal becomes meaningful when the page is on an unrelated host and the borrowed brand references line up with phishing behavior.
- one random brand link on a normal article is not enough
- a fake login page plus multiple PayPal references is much more suspicious
- hotlinked logos and official-looking footer links increase confidence
- the signal runs locally in the extension, so the page does not need to be uploaded for analysis
Related protection
Frequently Asked Questions
What is backlink impersonation?
It is a phishing tactic where a fake page links to real brand privacy pages, support centers, logos, or scripts to feel more legitimate than it really is.
Why is linking to a real privacy policy suspicious?
Because attackers use official-looking footer links as social proof. The real privacy page may be harmless, but it can still help a fake login page feel trustworthy enough to steal a password.
Does this run locally?
Yes. In the extension, the detector runs locally in your browser using the page references already visible in the DOM.
Catch phishing pages that borrow trust instead of earning it
PhishClean helps flag suspicious pages that lean on real brand links, assets, and support references to look safer than they are.
Install PhishClean