Phishing Kit Detection: Expert Strategies and Automation Playbooks

Phishing kit detection is the process of identifying the pre-packaged archives of software—typically containing HTML, PHP, and CSS files—that attackers use to rapidly deploy fraudulent websites. To protect your brand effectively, you must combine proactive Certificate Transparency (CT) monitoring with automated signature-based scanning to catch these kits before they harvest user credentials. Finding a phishing kit doesn't just stop one site; it often reveals the attacker's exfiltration methods, such as Telegram bots or "drop" emails, allowing you to neutralize their entire infrastructure.

The Anatomy of a Modern Phishing Kit

I have spent years deconstructing ZIP files found on compromised web servers, and the structure of a phishing kit is surprisingly consistent. Most kits are designed for "plug-and-play" deployment. An attacker buys a kit on a dark web forum or Telegram channel, uploads it to a hijacked WordPress site, and unzips it. Within seconds, they have a pixel-perfect replica of your login page.

A standard kit usually contains several specific components. There is the frontend, which consists of the HTML and CSS used to spoof the target brand. Then there is the backend logic, usually written in PHP, which handles the data theft. Finally, there is the exfiltration layer, which dictates where the stolen credentials go. In my experience, seeing how these files interact is the first step toward building a detection engine that actually works.

Key Takeaway: Phishing kits are modular. If you can identify the unique signature of a kit's backend script (like a specific variable name or a unique "thank you" page redirect), you can find every other instance of that kit across the internet.

Common Backend Exfiltration Methods

How does the attacker get the data? They don't usually store it on the hijacked server because it’s too easy for admins to find. Instead, they use "drops." I frequently see these three methods:

• Email Drops: The PHP script uses the mail() function to send credentials to a Gmail or ProtonMail account.
• Telegram Bots: Modern kits use the Telegram API. The script sends the username and password directly to a private Telegram chat controlled by the attacker.
• Discord Webhooks: Similar to Telegram, attackers use Discord channels to receive real-time notifications when a victim enters their data.

Detection often starts by looking for these API calls. If you see a newly registered domain making requests to api.telegram.org/bot, and that domain contains your brand name, you are looking at a live phishing kit.

Using Certificate Transparency for Early Phishing Kit Detection

One of the most effective ways to spot a phishing kit before it goes live is to monitor the issuance of SSL certificates. Most attackers now use Let's Encrypt or ZeroSSL to make their sites look "secure." Because every public certificate must be logged, we have a real-time stream of every new site being built.

By implementing Certificate Transparency monitoring, your security team can receive an alert the millisecond a certificate is issued for a domain like yourbrand-login-verify.com. This gives you a window of opportunity to investigate the site before the attacker even starts sending out phishing emails.

I recommend setting up filters that look for your brand name combined with high-risk keywords. Common keywords include "login," "secure," "account," "verify," and "support." When a match occurs, your system should automatically trigger a "head" request to the URL to see if it returns a 200 OK status, then pass it to a sandbox for kit analysis.

Identifying Kits through Signature-Based Analysis

Once you have a suspicious URL, how do you prove it's a phishing kit? This is where signature-based detection comes in. Many kits are reused thousands of times without the code being changed. This "laziness" is a defender's greatest advantage.

Writing YARA Rules for Phishing Kits

YARA is the industry standard for pattern matching. You can use it to scan the source code of suspected pages for specific strings that are common in phishing kits but rare in legitimate software. For example, many kits include a file called result.php or post.php that contains specific variable names for the stolen data.

Below is a simple YARA rule I've used to identify kits targeting financial institutions. It looks for common patterns in the exfiltration logic:

rule Phishing_Kit_Exfiltration_Logic {
    meta:
        description = "Detects common PHP exfiltration patterns in phishing kits"
        author = "ThreatRecon Expert"
    strings:
        $p1 = "mail($to, $subject, $message,"
        $p2 = "api.telegram.org/bot"
        $p3 = "$_POST['password']"
        $p4 = "chat_id"
    condition:
        2 of them
}

When your crawler hits a site, it should pull the HTML and any accessible PHP files (if the attacker left the ZIP file in the root directory, which happens more often than you'd think) and run these rules. If you find a match, you can confidently move to the takedown phase.

Advanced Detection: Homoglyphs and Typosquatting

Attackers don't always use obvious names. Sometimes they use homoglyph attacks, where they replace a Latin 'a' with a Cyrillic 'а'. To the human eye, the URL looks perfect. To a computer, it's a completely different domain.

Your detection strategy must include a "fuzzy matching" engine. Instead of just looking for example.com, you should be looking for exampIe.com (with a capital 'i' instead of an 'l') or exämple.com. Combining this with domain spoofing prevention techniques ensures that you aren't blindsided by these subtle variations.

The "Unzipped Kit" Vulnerability

A pro tip for SOC analysts: always check if the attacker left the source ZIP file on the server. Many attackers upload kit.zip or office365.zip, unzip it, and forget to delete the archive. If you can download this archive, you have the "smoking gun." You can see the attacker's email address, their Telegram bot token, and every other site they might be targeting. This is the gold standard of phishing kit detection.

Automating Your Detection Pipeline with Python

Manual checking doesn't scale. If you are a growing SaaS company, you might face dozens of new impersonation attempts every week. You need an automated pipeline that connects your monitoring tools to your analysis engine.

Here is a conceptual Python workflow that I've seen work effectively for small security teams. This script takes a list of new domains (perhaps from a CT log feed) and checks them for common phishing kit markers.

import requests
import re

def check_phishing_kit(url):
    try:
        # Check for the existence of common kit archives
        kit_names = ['kit.zip', 'login.zip', 'webmail.zip', 'scam.zip']
        for kit in kit_names:
            target = f"{url}/{kit}"
            response = requests.head(target, timeout=5)
            if response.status_code == 200:
                print(f"[!] POTENTIAL KIT FOUND: {target}")
                return True
        
        # Scan page source for Telegram bot tokens
        page_source = requests.get(url, timeout=5).text
        if "api.telegram.org/bot" in page_source:
            token_match = re.search(r'bot(\d+:[A-Za-z0-9_-]+)', page_source)
            if token_match:
                print(f"[!] TELEGRAM BOT TOKEN DETECTED: {token_match.group(1)}")
            return True
            
    except Exception as e:
        pass
    return False

# Example usage
# check_phishing_kit("http://suspicious-brand-login.com")

By running a script like this against every new domain found via your brand abuse monitoring efforts, you can automate the discovery of the underlying infrastructure. This moves your team from reactive "whack-a-mole" to proactive threat hunting.

Comparing Detection Methodologies

Not all detection methods are created equal. Depending on your resources and the volume of attacks, you may prioritize one over the other. The table below compares the most common approaches I use in the field.

The Incident Response Playbook for Phishing Kits

Finding the kit is only half the battle. Once detected, you need to move fast. Phishing sites often have a lifespan of less than 24 hours. If your response takes two days, the damage is already done. Here is the playbook I recommend for every SOC team.

1. Verify and Document: Take screenshots of the site and download the source code if possible. Use tools like urlscan.io to get a clean, permanent record of the threat.
2. Identify the Host and Registrar: Use WHOIS lookups to find where the domain is registered and where the files are hosted.
3. Send Abuse Reports: Contact the hosting provider and the registrar immediately. Most reputable providers have automated systems for this. If the site is behind Cloudflare, use the Cloudflare abuse report process.
4. Blacklist the URL: Submit the URL to Google Safe Browsing and Microsoft SmartScreen. This will trigger a "Red Screen" warning in users' browsers, effectively killing the site's conversion rate.
5. Neutralize the Exfiltration: If you found a Telegram bot token or an email address in the kit, report those to the respective platforms. This can stop the attacker from receiving any more data, even if the site stays up.

For a more detailed breakdown of these steps, you should consult our guide on how to takedown a phishing site. Speed is your most important metric here. In my experience, an automated report sent within 30 minutes of detection has a significantly higher success rate than a manual report sent the next morning.

Advanced Evasion Techniques to Watch For

Attackers are not standing still. They know we are scanning for their kits, so they use several evasion techniques to hide. If your detection logic is too simple, you will miss these.

Geofencing: Some kits check the IP address of the visitor. If the IP belongs to a security company (like Palo Alto, Zscaler, or Google), the kit shows a perfectly legal page. If the IP belongs to a residential ISP in the target country, it shows the phishing page. To beat this, you must use a proxy network when scanning.

User-Agent Filtering: Kits often block requests from "headless" browsers or common scraping tools like curl or python-requests. Your automation must use realistic User-Agent strings and mimic human behavior (like moving the mouse or waiting a few seconds) to trigger the malicious payload.

Code Obfuscation: I often see PHP scripts where every variable is a random string of characters, or the entire logic is Base64 encoded. Simple string matching won't find these. You need to look for the "decoding" functions themselves, such as eval(base64_decode(...)), which are rare in legitimate business applications but common in malware and phishing kits.

Expert Warning: If you find a site that appears blank but has a high visual similarity score in your monitoring tool, it's likely using geofencing. Always re-scan using a residential proxy before marking it as a false positive.

Scaling Brand Protection for Startups

If you are a small team, you cannot spend all day hunting for ZIP files. You need to focus on high-impact activities. Start by securing your own DNS and implementing DMARC to prevent direct spoofing. Then, move to automated monitoring.

By using tools that aggregate CT logs and perform automated YARA scanning, you can cover 90% of the threat surface with 10% of the effort. The goal of phishing kit detection isn't to find every single kit on the internet; it's to find the ones targeting your customers and your brand identity. Focus on the high-risk indicators first, and use the playbooks mentioned above to automate the "boring" parts of the response.

In my years of doing this, I've found that the most successful brand protection programs are the ones that treat security as a data problem. The more data you collect from CT logs, DNS changes, and kit signatures, the more patterns you see. And once you see the patterns, the attackers have nowhere left to hide.

Frequently Asked Questions

What is a phishing kit?

A phishing kit is a bundled set of software tools, usually in a ZIP file, that allows an attacker to quickly set up a fake website. It includes HTML pages that mimic a real brand and backend scripts (like PHP) to steal and exfiltrate user credentials.

How do you detect a phishing kit?

Detection involves monitoring for new, suspicious domains via Certificate Transparency logs and using signature-based tools like YARA to scan website source code for known malicious patterns or exfiltration scripts.

What should I do if I find a phishing kit?

You should immediately document the evidence, report the URL to the hosting provider and domain registrar for a takedown, and submit the link to Google Safe Browsing to protect users. If you find exfiltration tokens (like Telegram bots), report those to the service provider to cut off the attacker's data stream.

Why are phishing kits so dangerous?

They lower the barrier to entry for cybercrime, allowing unskilled attackers to launch sophisticated-looking attacks. Because they are easily distributed, a single kit can be used to create thousands of identical phishing sites in a very short time.