How To Construct A Phishing 🎣 Web Page

The Basics of How to Create a Phishing Web Page

First I want to say we do not condone creating a phishing web page. In most cases, it is immoral and illegal. It is a breach of privacy. There are certain scenarios where creating a phishing web page can be justified. For example if you think your wife is cheating on you and you want to get her email account and password so you can see if she is getting or sending emails she shouldn't be.

There are 4 elements of creating a phishing web page:

1. Creating the web page that should look and behave EXACTLY like the web page you are trying imitate.
2. Getting a domain name that looks as much as possible as the real domain name. For example, if you are trying to create a Yahoo mail phishing page, the real web address is https://mail.yahoo.com. You want to get a domain name that looks as close to this as possible such as https://mail.yahooo.com for example.
3. Getting web hosting so you have a place on the internet where the files to your phishing web page will be hosted. DO NOT be a cheapo here and try to use a free web hosting service like Weebly or Wix for this because you will be MUCH less likely to get away with it because the domain or web address will not look at all like the real thing and it will be a lot tougher to make your phishing web page look and act like the real website.
4. Getting the username and password sent to you so you can log in to the real account.

In order to creating a phishing web page you obviously have to have some sort of knowledge of creating a web page which is beyond the scope of this article. If you don't know much about creating web pages ...

We can create the following phishing web pages for you:

If the phishing web page you want created is not in the list above, contact us and tell us the phishing web page you want and we will reply with a price quote.

If you select the option that includes the domain name and the web hosting ($199), everything will be done for you:

1. The purchase of the domain name (domain name is active for 1 year).
2. The purchasing of the web hosting (web hosting is active for 1 year).
3. Creating the phishing web page and uploading the necessary files to the web host.
4. Setting the page up so the username and password get emailed to you.

Meaning you don't have to do a thing except sit back act wait for usernames and passwords to be emailed to you.

If you select the option that does NOT include the domain name and the web hosting ($99) we will be responsible for:

1. Creating the phishing web page.

It will be your responsibility to purchase the domain name and hosting as well as uploading the files to a web host.

If you you decide to create your phishing web page yourself, you have to make the phishing page look and behave exactly like the real thing.

If you do a poor job with this, the person will know the page is not legit and not enter their username and password. Also, they will probably report the page to Google which will make it so in the future, when anyone tries going to your phishing page they will be shown a warning to stay away from your page because it is a phishing page.

Google Deceptive Site Warning

Google Deceptive Site Warning

The Visual Aspects of Creating a Phishing Web Page

This requires a certain amount of knowledge about creating web pages. If the phishing page does not act and look like the real thing then people are likely to know something is up and get suspicious. Keep in mind that the web page must respond and behave appropriately for different screen sizes, from cell phone screens to tablets to computer screens.

The Most Important Part of Creating a Phishing Web Page - Getting the Username & Password

The most important part is the form on the phishing web page which will contain the text boxes for entering a username and password and the button to submit the form data.

You want to configure the form so that when the person clicks the submit or log in button, their username and password gets sent to you at any email address you wish. Once the submit or log in button has been clicked, you then want to seamlessly redirect the user to the real website you are imitating with your phishing web page.

Most people will simply think that for some reason, there was some sort of error logging in and just re-enter their username and password on the real website. Again, doing this properly is critical because if the person suspects they have been phished they will most likely change their password and you won't be able to log in with the username and password that gets sent to you. This is why it is critical that your phishing web page looks and acts like the real thing.

Creating and using a phishing web page, despite moral and legal implications, is actually quite fun. Getting someones username and password to an online account is a huge responsibility so please exercise caution and make sure your reasons for creating and using a phishing web page are justified.

If your goal is to get the username and password from one specific person, it is a good idea to immediately take down the phishing web page as soon as the goal is accomplished. If your creating a phishing web page for the purpose of hurting or defrauding the general public, you are seriously treading on thin ice and can get into real trouble for this, so it is highly discouraged.

You may be interested in reading about how to tell if a web page is a phishing web page so you don't fall victim to this yourself.