Rules for identifying phishing and fraudulent sites

1. Scope

1.1. The rules apply to all content distributed by Layero:

• sites at addresses <label>.layero.app and mirror <label>.layero.dev;
• addresses of branches and previews;
• temporary sites published without registration;
• sites on clients' own domains if the content is hosted in Layero.

1.2. The rules apply to any plan and any account age. The paid plan, the age of the account and the fame of the owner do not make the violation permissible.

1.3. What the visitor sees is evaluated: the page itself, its scripts, built-in elements, pop-up windows and addresses to which the site redirects. Embedded third-party deceptive content - advertising, widget, chain of redirects - is considered a violation of the site that displays it. That's how Google sees it too.

2. Categories of violations

Each category is described as follows: what it is, by what criteria it is determined and what the violation not is considered. The decision is made based on a combination of signs, and not on one word on the page.

F1. Phishing - collecting credentials of someone else's service

What is this. The page lures data that allows access to someone else’s service or a person’s money, and at the same time impersonates this service or a trusted intermediary.

The following data:

• login and password from mail, bank, public services, marketplace, messenger or social network;
• code from SMS or one-time code for logging into someone else’s account or confirming a transaction;
• bank card data under the guise of a bank, payment system or government agency;
• recovery phrase or private key of the crypto wallet, connecting the wallet to the service that withdraws funds.

Signs:

• a form for entering such data on a website that looks like someone else’s service: name, logo, design, address with the brand name (“sign-in”, “account-verification”, “sber-...");
• bait “confirm account”, “account will be blocked”, “security check”;
• the entered data goes to the Telegram bot or to a third-party domain;
• the page collects the visitor's IP address through third-party services;
• the logo is substituted for the email domain entered by the visitor - a typical set for stealing email passwords;
• obfuscated code that hides where the data goes.

It is not a violation:

• username and password login to own site owner service: account, CRM, admin panel, electronic diary;
• buttons “Log in via Sber ID / Yandex ID / VK ID / Google”, in which the password is entered on the provider’s website;
• a site operating on behalf of a partner, if the relationship is clearly indicated on each page: “site of company X for clients Y”, “official partner of Y” (as required by Google).

F2. Deceptive content - social engineering without form

What is this. The page forces a person to do what he would do only for a trusted party: call “support”, download a program, disable protection, transfer money.

Signs:

• fake system windows and warnings: “your computer is infected”, “update your browser”, “install the player”;
• fake “official support” with phone number or contacts;
• the “Download” and “Watch” buttons, behind which the download of another is hidden;
• advertising impersonating page controls;
• "generators" of free subscriptions, currency or credits in app stores.

It is not a violation: honest banners and owner buttons, advertising that is clearly distinguishable from the content of the page.

F3. Fraud bait

What is this. The page promises benefits to get money, phone, code or card details, or takes the person to a place where it will be taken from him.

Signs:

• “vote for me”, sweepstakes, winnings, gifts, “payments from the state”, compensation, free or unrealistically cheap goods and services;
• “test your partner’s fidelity”, “find out your husband’s correspondence”;
• earnings that require a withdrawal fee, an “investment” with a promised return;
• selling goods without the intention of sending, prepayment for something that does not exist, hidden subscriptions and charges;
• transition from such a page to a third-party domain where they ask for a phone number, a code from an SMS, or card details.

It is not a violation:

• real competitions and promotions of the organizer with conditions that do not collect credentials of other people's services and do not take them to a third-party site;
• regular sale of goods and services with your own payment.

F4. Brand counterfeiting (mimicry)

What is this. The site copies the look, name or functions of a well-known or official resource and does not say that it is not one. This also includes a fictitious “official” resource that does not exist.

Signs:

• the address, logo, icon, title or design is identical to the original;
• a fake payment page or “account dashboard” of the brand;
• "official" non-brand contacts and support.

It is not a violation: fan sites, reviews, unofficial clients and partner sites, if the relationship to the brand is clearly indicated - “unofficial site”, “fan site”, “partner site”. The indication must appear in the title of the page and at the beginning of its text (as required by Yandex).

F5. Hidden forwarding and cloaking

What is this. The site does not show the visitor what it promises, or quietly takes him to an unrelated resource.

Signs:

• redirector site: the address in Layero only redirects to a third-party domain, especially if it collects data or money;
• redirection for no clear reason - by time, by referral source, only for mobile phones;
• the site does not open from a direct link or opens blank, but from a search or newsletter it shows different content.

It is not a violation:

• open redirection with a clear reason: moving to the owner’s own domain, “go to site” link;
• A/B tests, regional content, device adaptation.

F6. Malicious and unwanted software

What is this. The site distributes or launches something that harms the device or user.

Signs:

• files with viruses, spyware and adware;
• downloading without explicit consent or the file is not the type that was promised;
• installers who silently install unnecessary things or pretend to be official software from another company;
• hidden mining in the browser, substitution of the content of other people's pages;
• “drainers” of crypto wallets.

It is not a violation: honest distribution of your own programs with an explicit signature of what is being downloaded and why.

Related violations

Pirated content, open proxies, spam landing pages and illegal materials are not phishing. They are considered under clause 4.2 of the Agreement and the “Complaint about the site” page, and the rights of copyright holders - in the manner described there.

Clarification dated October 24, 2026. VPN servers, proxies and tunnels used to access resources blocked under Russian law from within Russia are reviewed under clause 4.2 of the Terms and the rules for reviewing reports of blocking circumvention services. The presence of a VPN alone does not indicate phishing or a violation; we consider the exception for technological purposes in Part 17 of Article 15.8 of Law No. 149-FZ.

3. Degree of confidence and decisions

3.1. A site with F1 characteristics, created on the first day of an account’s life, is checked out of turn: this is what most fraudulent campaigns look like.

3.2. Disabling is reversible: the content is not deleted, the site stops opening and shows visitors the “Site is blocked” screen. Only Layero support, not the site owner, can remove a block for violating these rules.

3.3. Automatic checks only select candidates, the decision on them is made by the moderator. Without a moderator, the site is disabled only based on the exact characteristics of an already known campaign, for example, the address where visitors are being taken, or its typical title.

4. Campaigns and repeat violations

4.1. Campaign - several sites of one account or related accounts with one bait, one template or one address where visitors are taken. A confirmed violation on one campaign site means that all of its sites are disabled and accounts are blocked.

4.2. Bypass rules. Re-posting disabled content under a new address, in a new project, or from a new account is a violation in itself. Such a site is disabled without re-verification, and the account is blocked. Google explicitly calls crawling through new subdomains a violation.

4.3. Repeated violation. If the site, after restoration within 30 days, violates the rules again, it is disabled without the right to recovery, and the account is blocked. This complies with Google's repeat infringer policy.

5. How the test is carried out

5.1. Signal sources:

• complaints via layero.ru/abuse and support@layero.ru;
• Google Search Console and Yandex Webmaster notifications by domain layero.app and layero.dev;
• checking website addresses with the Google Web Risk database;
• own check of new and updated sites based on the characteristics of section 2.

5.2. Recording the issue. For each solution, the page address, scan time, features found, and a snapshot or excerpt of the content are stored. Checks and their results are kept in a journal. The storage period for the log is 90 days, unless there is a dispute or request from an authorized body in the case.

5.3. Checking without harm to visitors. Sites are checked one at a time, with pauses, so as not to load the applications of other clients. Phishing content is not republished or made publicly available, including in tests and examples.

5.4. Timing - on the “Complaint about the site” page:

• confirmation of receipt of the complaint - within one business day;
• phishing and malware - out of turn, usually within 24 hours;
• the rest - up to three working days.

5.5. Appeal. The owner of a disabled site writes to support@layero.ru and attaches an explanation. If the violation is not confirmed, the site is restored and the violation mark is removed.

5.6. Search engines and browsers. If Google or Yandex has flagged an address on the Layero domain, the offender is disabled, after which a review is requested via Search Console and Yandex Webmaster. Google's answer is from several days, Yandex's - up to 30 days.

6. What Layero does as hosting

According to Google's recommendations for hosting Layero user-generated content:

• publishes the rules during registration - this is the User Agreement and this document;
• accepts complaints on the page layero.ru/abuse without registration;
• limits temporary sites without registration: lifetime - an hour, closed from search engines, captcha check;
• confirmed rights to domains layero.app and layero.dev in Google Search Console to receive tag notifications;
• checks website addresses with the Google Web Risk database and reports findings to the moderator;
• disables violators within the time limits from section 5 and blocks entire campaigns.

7. Revision

7.1. The rules are reviewed after each incident in which the site went unnoticed, and at least once a quarter.

7.2. Changes are published in a new edition with a date. Previous editions are retained.