Ask HN: Can I Know If My Website Is Being Spoofed?

For example, say I own "bank.com". A phisher purchases "bank.evil".

They make the login page at "bank.evil" look like the one at "bank.com"

Whenever a victim goes to "bank.evil" it connects to a server, that connects to an automation-tool, that connects to "bank.com"

Whatever the victim does at "bank.evil", the phisher's browser does at "bank.com".

Any solution that has you perform an action on the site that initiated the request might just be the evil site asking for your information for the legit site.

Are there any techniques or products that foil this threat?

- OTP, SMS, Push, etc would fail I think because you're putting the proof that you own the account into a tainted site.

- WebAuthn might work because of the SameOrigin rule

- E-Mail might work because you sever the instructions from the spoofed browser

Thanks!

(edit: formatting)