Pith. sign in

REVIEW 3 major objections 6 minor 68 references

Characterizing Phishing Pages by JavaScript Capabilities

T0 review · 3 major / 6 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Phishing pages can be grouped by the set of browser APIs their first-party scripts execute, and this dynamic signature identifies the underlying phishing kit family with 97% pairwise clustering accuracy.

desk verdict A genuinely useful dynamic-feature approach to grouping phishing pages by kit, but the 97% FMI depends on a ground-truth mapping the authors admit they did not verify, so the headline should be read as conditional. read the letter →

arxiv 2509.13186 v2 pith:YXWEGC4X submitted 2025-09-16 cs.CR

Aleksandr Nahapetyan , Kanv Khare , Kevin Schwarz , Bradley Reaves , Alexandros Kapravelos This is my paper
classification cs.CR
keywords phishingkitsbrowserAPIsJavaScriptdynamicanalysisclusteringkitfingerprintingclient-sidecloakingecosystemmeasurement
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the set of browser APIs a phishing page actually executes is a reliable fingerprint of the phishing kit behind it. Using an instrumented browser to trace 1.3 million pages and recovering kit archives for thousands of them, the authors cluster pages by the Jaccard similarity of their first-party API sets. On 4,562 pages with known kit families, this clustering matches the true kit families with 97% Fowlkes-Mallows accuracy and 91% V-measure, and it still holds at 69% when the most mass-deployed kit is down-sampled. The practical payoff is that defenders can automatically aggregate phishing pages by kit family—without manual signature building—and measure how common techniques such as fingerprinting, obfuscation, and cloaking are across the ecosystem.

What carries the argument

The central object is the first-party browser API set: the unordered collection of WebIDL APIs (function calls, property reads, property writes) executed by scripts loaded from the same domain as the phishing URL, excluding cloud-proxy scripts. Similarity between two pages is the Jaccard index of these sets; density-based hierarchical clustering groups pages by this distance, after merging local clusters across rolling time windows. Ground truth is constructed by recovering kit archives from the host servers, de-duplicating archives into families by a 90% Jaccard threshold on the SHA-256 hashes of their source files, and mapping URLs to families.

What would settle it

For a sample of, say, 100 labeled URLs, run the recovered kit archive in the same instrumented browser on a clean domain and compare the resulting first-party API set with the one captured from the live phishing page; if the typical Jaccard similarity is far below the 98.6% same-family average, the ground-truth label noise is too high for the 97% Fowlkes-Mallows score to be attributed to the API-set-to-kit relationship.

Watch

Extended reading notes

Core claim

The paper's central claim is that the unordered set of browser APIs executed by first-party scripts on a landing page encodes enough of the kit author's design choices to identify which phishing kit family produced the page. Across a ground-truth set of 548 kit families deployed on 4,562 URLs, pages from the same family share on average 98.6% of their executed API sets, while pages from different families share only 15.9%. Clustering these sets with hierarchical density-based clustering and a Jaccard distance kernel separates kit families with a Fowlkes-Mallows index of 0.97 and a V-measure of 0.91—substantially better than prior attempts based on static DOM or URL features. The same approac

Load-bearing premise

The recovered zip archive is assumed to be the kit that actually produced the page's observed behavior; the paper acknowledges in Section 8 that it does not verify this mapping, and a mismatch on a substantial fraction of the 4,562 labeled URLs would break the claimed accuracy.

Editorial extensions

If this is right

  • Defenders can automatically group phishing pages by kit family from dynamic execution traces alone, without building static signatures per kit.
  • Browser API usage distinguishes kits better than script hashes, including hashes of scripts extracted from eval(), so dynamic behavior is a stronger kit fingerprint than code identity.
  • At ecosystem scale, UI interactivity and basic fingerprinting are near-universal (observed in about 90% and 80% of clusters), while mouse detection, Cloudflare Turnstile embedding, and pop-up-based bot detection are rare and kit-specific.
  • Phishing pages execute, on average, only 11% of the browser APIs their target brand's legitimate pages execute, so the API signal reflects the kit, not the impersonated brand.
  • Most clusters (69%) target a single brand, suggesting deployed phishing kits are increasingly specialized to one brand.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the 97% result holds up, a natural extension is to use cluster labels as training signal for a classifier that predicts a specific kit family from an API set; precision on known families would be high, but generalization to never-before-seen kits is untested.
  • If DOM APIs and property reads carry kit-identity signal (as the paper's ablation indicates), then a kit that swaps its UI framework should split into a new sub-cluster, making API-set clustering a way to observe kit evolution over time.
  • The 90% file-hash Jaccard threshold used to merge archives into families is itself a modeling choice; a different threshold could yield coarser or finer kit definitions and shift the reported metrics, so the family boundaries and the 97% accuracy are coupled.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes clustering phishing pages by the set of browser APIs executed by first-party scripts, using VisibleV8 traces, and evaluates whether these clusters correspond to underlying phishing-kit families. On a ground-truth set of 4,562 URLs mapped to 548 kit families (recovered via KitPhishr archives), the authors report a Fowlkes-Mallows index (FMI) of 0.97 and a V-measure of 0.91, and they further cluster 434k unlabeled phishing pages into about 11k clusters to estimate the prevalence of client-side techniques. The main claim is that API-usage sets are a strong, automatically extractable signal for grouping phishing pages by kit family.

Significance. If the central claim holds, the work would be a valuable step toward automated phishing-kit attribution at scale, complementing prior static-analysis approaches. The paper's dynamic-analysis methodology, large crawl (1.3M URLs), and the public availability of VisibleV8 and KitPhishr as building blocks are strengths. The authors also honestly disclose the rebalanced FMI of 0.69, which is important. However, the significance is materially tempered by the unverified ground-truth mapping and by internal inconsistencies in the reported cluster counts. The contribution is potentially important but requires revision before the headline numbers can be trusted.

major comments (3)
  1. [Section 8 / 'Incorrect Ground truth mapping'; §3.3] The central evaluation compares API-set clusters against kit-family labels derived from KitPhishr-recovered archives. Section 8 explicitly concedes: "we do not verify if the kit acquired is the kit deployed on the page." This is the load-bearing assumption behind the 97% FMI and 91% V-measure. If a non-trivial fraction of the 4,562 labeled URLs have stale or mismatched archives (leftover zips, shared hosting, kit uploaded but not deployed), the reported metrics do not measure the API-to-kit relationship. The manuscript provides no audit of this mapping (e.g., comparing recovered archive contents to the scripts actually executed in the VisibleV8 trace, or manually validating a sample). Please provide such an audit or a formal sensitivity analysis; without it the headline claim cannot be interpreted.
  2. [§5.1, Contribution C1, Abstract] The 97% FMI is heavily influenced by one kit ("2e94aff28a2c", a Wells Fargo kit, 1,073 of 4,562 URLs). The authors disclose that rebalancing to 104 pages per class drops FMI to 0.69, yet the abstract and introduction still headline the unrebalanced 98%/97% figure. Because FMI is pair-counting, a dominant class can inflate the score, and 0.69 is materially lower than the claimed "97% accuracy." The contribution should be reframed around the rebalanced result (or another class-balanced metric), or the authors should justify why the un-rebalanced number is the appropriate headline.
  3. [Abstract, §4.2, §5.2, §9] The unlabeled dataset size and cluster count are stated inconsistently. The abstract says "434,495 phishing pages ... cluster into 9,306 clusters," while the introduction and conclusion say "434,050 pages" grouped into "11,377 clusters." Section 4.2 reports "only 434,050" pages with no final cluster count, and §5.2's "1,253 clusters (19%)" implies a different denominator (1,253/11,377 ≈ 11%). These discrepancies must be resolved for reproducibility and for the ecosystem-level findings (Findings 5–12) to be interpretable.
minor comments (6)
  1. [Abstract, §5.1] The abstract reports "98% accuracy" while the body reports "97% FMI" and, in the same abstract, "97%" appears later. Use a single consistent term (e.g., FMI-based accuracy) and reconcile the numeric difference.
  2. [§4.1] The text reads "we group these kits into 2,00 families" — likely a typo for 2,000.
  3. [§3.3] The temporal merge description is ambiguous: "merge any two clusters with at least 1 page in common between local clusters and merge them using the representative API set." Clarify whether pages in common are used to link clusters directly and how representative API sets are combined before DBSCAN.
  4. [§5.2] The statement "1,253 clusters (19%) of the clusters had two brand labels" does not match either 11,377 or 9,306 as the total cluster count. Please correct the percentage or the count.
  5. [§8] Typo: "Multi-page memebr clusters" should be "members." Also, "Addressing this limitation" begins with an uncapitalized word mid-sentence.
  6. [Table 3 and §5.3] The table lists "Textdecoder.decode" but the API is TextDecoder.decode; also "eval" is formatted inconsistently. In Finding 10, the sentence "At the same time, we discussed the presence of WebAssembly-based captchas for bot detection" is incomplete and should be rephrased.

Circularity Check

0 steps flagged · score 0.0 of 10

No self-definitional or fitted-input circularity: ground-truth kit labels are external (KitPhishr zip archives), and the 97% FMI claim is evaluated against those labels rather than constructed from them.

full rationale

The paper's central derivation chain is: (1) collect browser API execution traces with VisibleV8, an independently developed instrumented browser; (2) construct ground-truth kit labels by recovering zip archives with KitPhishr and de-duplicating them via SHA256 hashes and Jaccard similarity of source-file hash sets; (3) cluster pages solely from Jaccard distance over 1st-party API sets using HDBSCAN; (4) evaluate the resulting clusters against the independently obtained kit labels using FMI and V-measure. The labels are not derived from the API traces, so the headline accuracy does not reduce to a self-definitional identity. The paper explicitly acknowledges the main ground-truth risk in Section 8 ('Incorrect Ground truth mapping: ... we do not verify if the kit acquired is the kit deployed on the page'), but that is an external validity threat, not circularity: a mismatched archive would add noise to the labels rather than force the cluster evaluation to a predetermined value. The threshold choice in Section 5.1 ('We ultimately chose four browser APIs as the requirement for further experimentation on the ground truth data') is a hyperparameter selection on the labeled set and could inflate the reported FMI, but the clustering itself does not incorporate the labels, the paper also reports a rebalanced FMI of 0.69, and the relationship between API-set similarity and kit-family identity is a measured empirical association rather than a fitted parameter renamed as a prediction. Self-citations to VisibleV8, FV8, and prior fingerprinting API lists are citations to established tools and prior measurements, not load-bearing justifications that reduce the present claims to those citations. No circular step satisfies the required standard of exhibiting a specific reduction of the output to the input.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central accuracy claim rests on ground-truth kit labels that come from recovered zip archives, which the paper itself acknowledges are not verified to be the deployed kits. The clustering thresholds (min APIs, DBSCAN epsilon) are hand-chosen with the labeled data, and the technique prevalence results depend on a manual API-to-technique mapping. No new physical or technical entities are introduced.

free parameters (3)
  • Minimum distinct first-party API threshold = 4 (labeled), 8 (unlabeled)
    Chosen based on ground-truth V-measure/coverage tradeoff in Figure 6; affects which pages enter clustering and thus the reported FMI and cluster counts.
  • DBSCAN merge epsilon = 0.05
    Hand-selected as 'conservative' for merging local clusters; not derived from data. Directly affects the number of final clusters in the unlabeled dataset.
  • Kit-family Jaccard threshold = 0.90
    Definitional threshold for grouping extracted kits into families; changes ground-truth labels and hence the accuracy evaluation.
assumptions (4)
  • domain assumption VisibleV8 execution traces accurately capture the JavaScript APIs a page executes during a 45-second visit.
    The entire feature space is defined by these traces; inaccuracies due to cloaking or unvisited page states are acknowledged in Section 8 ('Unexplored Page states').
  • domain assumption The phishing kit archive recovered by KitPhishr URL fuzzing is the kit actually deployed on that page.
    All ground-truth labels and the headline accuracy depend on this; Section 8 states 'we do not verify if the kit acquired is the kit deployed on the page.' This is the weakest assumption.
  • domain assumption First-party scripts (same root domain as the submitted URL) correspond to the phishing kit's code, while third-party scripts are noise.
    Used in Section 3.2.1 to isolate 1st-party API sets; exceptions for Cloudflare Turnstile scripts are handled separately.
  • domain assumption The manual mapping of browser APIs to phishing techniques (Table 1) is correct.
    Findings 6-11 and the confusion matrix rely on this mapping; the paper states it may overestimate rare techniques (Section 6.2).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Characterizing Phishing Pages by JavaScript Capabilities." pith.science (2026). https://pith.science/paper/YXWEGC4X

@misc{pith2026250913186,
  author       = {Pith},
  title        = {Pith review of: Characterizing Phishing Pages by JavaScript Capabilities},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YXWEGC4X}},
  note         = {Machine review of arXiv:2509.13186}
}
read the original abstract

Phishers achieve large-scale attacks by using ready-to-deploy phishing websites (phishing kits) to rapidly launch campaigns that leverage specific data exfiltration, evasion, or mimicry techniques. In contrast, researchers and defenders continue to rely on manual analysis to identify features for kit fingerprinting. In this paper, we examine the link between a page's client-side behavior and the underlying phishing kit used, enabling automated aggregation of phishing pages. Our key insight is that client-side techniques make heavy use of browser APIs, which, in turn, differentiate underlying kits based on their feature sets. Using an instrumented browser and a URL fuzzing utility, we collected traces from 1,328,917 pages and recovered kit archives for 4,180 pages between August 2023 and January 2025. For the labeled subset, we find that clustering based on the set of browser APIs executed yields 98% accuracy in grouping them by the underlying kit. We also find that 434,495 phishing pages execute enough browser APIs to cluster into 9,306 clusters, compressing multi-lingual phishing pages across various domains into a single cluster. Our findings show that analysts and researchers can leverage the complexity of client-side phishing code to track phishers' kit deployments in the wild.

Figures

Figures reproduced from arXiv: 2509.13186 by the authors.

Figure 1
Figure 1. Comparison between monthly unique domains ob [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Example of a phishing page in our dataset that em [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Crawling and clustering infrastructure we extracted tuples of the original page’s URL, the script’s URL, and an unordered set of APIs executed by this script. To not introduce artifacts into our clusters from cloaked pages and 3rd-party scripts like Google Analytics, known to be present in phishing pages [33], we isolate API sets executed by 1st-party scripts (from now on called 1st-party API sets). We establish the… view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Distribution of the Silhouette Score of local clusters [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Example of pages from two different pages and embedding between them. We used t-distributed stochastic neighbor [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Validity measure for clusters vs. minmum distinct APIs required for clustering [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Distribution of unique brand labels per cluster (only [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: Cropped screenshots from Cluster-53d5c420, IP addresses and location redacted to ensure anonymity of the authors. [PITH_FULL_IMAGE:figures/full_fig_p017_8.png]
Figure 9
Figure 9. Figure 9: Timeline of the top 10 clusters based on the number of pages [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]
Figure 10
Figure 10. Figure 10: Confusion matrix between all of the techniques enumerated and cluster lifetime characteristics, normalized by row. [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

68 extracted references · 2 linked inside Pith

  1. [1]

    APWG Trends

    APWG | Phishing Activity Trends Reports. APWG Trends

  2. [2]

    A Sneaky Phish Just Grabbed my Mailchimp Mailing List. 13

  3. [3]

    Sophisticated Spearphishing Campaign Targets Govern- ment Organizations, IGOs, and NGOs | CISA

  4. [4]

    Threat Actor Leverages Compromised Account of For- merEmployeetoAccessStateGovernmentOrganization | CISA

  5. [5]

    MDN Docs, January 2025

    Eval mdn. MDN Docs, January 2025

    2025

  6. [6]

    Threat Actor Groups Tracked by Palo Alto Networks Unit 42, June 2024

    Unit 42. Threat Actor Groups Tracked by Palo Alto Networks Unit 42, June 2024

    2024

  7. [7]

    VisualPhishNet: Zero-Day Phishing Website Detection by Visual Similarity

    SaharAbdelnabi,KatharinaKrombholz,andMarioFritz. VisualPhishNet: Zero-Day Phishing Website Detection by Visual Similarity. InProceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, CCS ’20, pages 1681–1698, New York, NY, USA, November 2020. Association for Computing Ma- chinery

    2020

  8. [8]

    {PhishPrint}: Evading Phishing Detection Crawlers by Prior Profiling

    Bhupendra Acharya and Phani Vadrevu. {PhishPrint}: Evading Phishing Detection Crawlers by Prior Profiling. pages 3775–3792

Show all 68 references
  1. [9]

    eCrime Ex- change (eCX), 2025

    Anti-Phishing Working Group (APWG). eCrime Ex- change (eCX), 2025

    2025

  2. [10]

    Catching Phishers By Their Bait: Investigating the Dutch Phishing Land- scape through Phishing Kit Detection

    Hugo Bijmans, Tim Booij, Anneke Schwedersky, Aria Nedgabat, and Rolf van Wegberg. Catching Phishers By Their Bait: Investigating the Dutch Phishing Land- scape through Phishing Kit Detection. In30th USENIX SecuritySymposium(USENIXSecurity21),pages3757– 3774, 2021

    2021

  3. [11]

    Ricardo J. G. B. Campello, Davoud Moulavi, and Joerg Sander. Density-based clustering based on hierarchi- cal density estimates. In Jian Pei, Vincent S. Tseng, Longbing Cao, Hiroshi Motoda, and Guandong Xu, edi- tors,Advances in Knowledge Discovery and Data Min- ing, pages 160...

    2013

  4. [12]

    PhiKitA: Phish- ing Kit Attacks Dataset for Phishing Websites Identifi- cation.IEEE Access, 11:40779–40789, 2023

    Felipe Castaño, Eduardo Fidalgo Fernañdez, Rocío Alaiz-Rodríguez, and Enrique Alegre. PhiKitA: Phish- ing Kit Attacks Dataset for Phishing Websites Identifi- cation.IEEE Access, 11:40779–40789, 2023

    2023

  5. [13]

    USPS Phishing Scam Targeting iOS Users

    SANS Internet Storm Center. USPS Phishing Scam Targeting iOS Users

  6. [14]

    Do- mainLynx: Leveraging Large Language Models for Enhanced Domain Squatting Detection.ArXiv, abs/2410.02095, 2024

    Daiki Chiba, Hiroki Nakano, and Takashi Koide. Do- mainLynx: Leveraging Large Language Models for Enhanced Domain Squatting Detection.ArXiv, abs/2410.02095, 2024

    2024 arXiv

  7. [15]

    Recognize and report

    CISA. Recognize and report. Secure Our World

  8. [16]

    Phishtank,2025

    CiscoTalosIntelligenceGroup(Talos). Phishtank,2025

    2025

  9. [17]

    There is No Free Phish: An Analysis of “Free” and Live Phishing Kits

    Marco Cova, Christopher Kruegel, and Giovanni Vigna. There is No Free Phish: An Analysis of “Free” and Live Phishing Kits

  10. [18]

    Kitphishr:Atooldesignedtohuntforphishing kit source code

    cybercdh. Kitphishr:Atooldesignedtohuntforphishing kit source code. Github, 2023

    2023

  11. [19]

    Phishing De- tection Leveraging Machine Learning and Deep Learn- ing: A Review.IEEE Security & Privacy, 20(5):86–95, September 2022

    Dinil Mon Divakaran and Adam Oest. Phishing De- tection Leveraging Machine Learning and Deep Learn- ing: A Review.IEEE Security & Privacy, 20(5):86–95, September 2022

    2022

  12. [20]

    OnlineTrack- ing: A 1-million-site Measurement and Analysis

    StevenEnglehardtandArvindNarayanan. OnlineTrack- ing: A 1-million-site Measurement and Analysis. In Proceedings of ACM CCS 2016, 2016

    2016

  13. [21]

    A Method for Comparing Two Hierarchical Clusterings.Journal of the American statistical association, 78(383):553–569, 1983

    Edward B Fowlkes and Colin L Mallows. A Method for Comparing Two Hierarchical Clusterings.Journal of the American statistical association, 78(383):553–569, 1983

    1983

  14. [22]

    Magika: AI-Powered Content-Type Detection

    Yanick Fratantonio, Luca Invernizzi, Loua Farah, Kurt Thomas, Marina Zhang, Ange Albertini, Francois Galilee, Giancarlo Metitieri, Julien Cretin, Alexandre Petit-Bianco, David Tao, and Elie Bursztein. Magika: AI-Powered Content-Type Detection. InProceedings of the Internationa...

    2025

  15. [23]

    Catapult

    Google Inc. Catapult. Googlesource, 2025

    2025

  16. [24]

    Puppeteer, 2025

    Google Inc. Puppeteer, 2025

    2025

  17. [25]

    PhishEye: Live Monitoring of Sandboxed Phishing Kits

    XiaoHan,NizarKheir,andDavideBalzarotti. PhishEye: Live Monitoring of Sandboxed Phishing Kits. InPro- ceedings ofthe 2016 ACM SIGSAC Conference on Com- puter and Communications Security, CCS ’16, pages 1402–1413, New York, NY, USA, October 2016. Asso- ciation for Computing Machinery

    2016

  18. [26]

    New sophisticated email- based attack from NOBELIUM

    Microsoft Threat Intelligence. New sophisticated email- based attack from NOBELIUM

  19. [27]

    Franken- phish: TodayZoo built from other phish- ing kits

    Microsoft Threat Intelligence. Franken- phish: TodayZoo built from other phish- ing kits. https://www.microsoft.com/en- us/security/blog/2021/10/21/franken-phish-todayzoo- built-from-other-phishing-kits/, October 2021

    2021

  20. [28]

    Visi- bleV8: In-browser Monitoring of JavaScript in the Wild

    Jordan Jueckstock and Alexandros Kapravelos. Visi- bleV8: In-browser Monitoring of JavaScript in the Wild. InProceedings of the ACM Internet Measurement Con- ference (IMC), 2019

    2019

  21. [29]

    Phishreplicant: A language model- based approach to detect generated squatting domain names

    Koide, Takashi and Fukushi, Naoki and Nakano, Hiroki and Chiba, Daiki. Phishreplicant: A language model- based approach to detect generated squatting domain names. InProceedings ofthe 39th AnnualComputerSe- curityApplicationsConference,ACSAC’23,page1–13, 14 New York, NY, USA, ...

    2023

  22. [30]

    Catching Transparent Phish: Analyz- ingandDetectingMITMPhishingToolkits

    BrianKondracki,BabakAminAzad,OleksiiStarov,and Nick Nikiforakis. Catching Transparent Phish: Analyz- ingandDetectingMITMPhishingToolkits. InProceed- ingsofthe2021ACMSIGSACConferenceonComputer and Communications Security, CCS ’21, pages 36–50, New York, NY, USA, November 2021. ...

    2021

  23. [31]

    Hung Le, Quang Pham, Doyen Sahoo, and Steven C. H. Hoi. URLNet: Learning a URL Representation with Deep Learning for Malicious URL Detection.ArXiv, abs/1802.03162, 2018

    2018 arXiv

  24. [32]

    Be- neath the phishing scripts: A script-level analysis of phishing kits and their impact on real-world phishing websites

    Woonghee Lee, Junbeom Hur, and Doowon Kim. Be- neath the phishing scripts: A script-level analysis of phishing kits and their impact on real-world phishing websites. InProceedings of the 19th ACM Asia Confer- ence on Computer and Communications Security, pages 856–872. ACM

  25. [33]

    Phish- ing Vs

    KyungchanLim,JaehwanPark,andDoowonKim. Phish- ing Vs. Legit: Comparative Analysis of Client-Side Re- sources of Phishing and Target Brand Websites. InPro- ceedings of the ACM Web Conference 2024, WWW ’24, New York, NY, USA, 2024. Association for Computing Machinery

    2024

  26. [34]

    Phish in Sheep’s Clothing: Exploring the Au- thentication Pitfalls of Browser Fingerprinting

    Xu Lin, Panagiotis Ilia, Saumya Solanki, and Jason Po- lakis. Phish in Sheep’s Clothing: Exploring the Au- thentication Pitfalls of Browser Fingerprinting. pages 1651–1668

  27. [35]

    Inferring phishing intention via webpage appearance and dynam- ics: A deep vision based approach

    Ruofan Liu, Yun Lin, Xianglin Yang, Siang Hwee Ng, Dinil Mon Divakaran, and Jin Song Dong. Inferring phishing intention via webpage appearance and dynam- ics: A deep vision based approach. pages 1633–1650

  28. [36]

    Knowledge expansion and counterfac- tual interaction for {Reference-Based} phishing detec- tion

    Ruofan Liu, Yun Lin, Yifan Zhang, Penn Han Lee, and Jin Song Dong. Knowledge expansion and counterfac- tual interaction for {Reference-Based} phishing detec- tion. pages 4139–4156

  29. [37]

    Analysis of Back-Doored Phishing Kits

    Heather McCalley, Brad Wardman, and Gary Warner. Analysis of Back-Doored Phishing Kits. In Gilbert Pe- terson and Sujeet Shenoi, editors,Advances in Digital Forensics VII, pages 155–168, Berlin, Heidelberg, 2011. Springer

    2011

  30. [38]

    Introducing quieter permission UI for notifications

    PJ McLachlan. Introducing quieter permission UI for notifications. Chromium Blog

  31. [39]

    Tycoon2FA New Evasion Technique for 2025

    Rodel Mendrez. Tycoon2FA New Evasion Technique for 2025. spiderlabs blog

    2025

  32. [40]

    Phishing kits source code sim- ilarity distribution: A case study

    Ettore Merlo, Mathieu Margier, Guy-Vincent Jourdan, and Iosif-Viorel Onut. Phishing kits source code sim- ilarity distribution: A case study. In2022 IEEE Inter- national Conference on Software Analysis, Evolution and Reengineering (SANER), pages 983–994. ISSN: 1534-5351

  33. [41]

    PhishingDB, 2025

    Mitchell Krog and Nissar Chababy. PhishingDB, 2025

    2025

  34. [42]

    Restricting notifica- tion permission prompts in firefox

    Mozilla. Restricting notifica- tion permission prompts in firefox. hrefhttps://blog.mozilla.org/futurereleases/2019/11/04/restricting- notification-permission-prompts-in-firefoxMozilla Blog, November 2019

    2019

  35. [43]

    On SMS Phishing Tactics and Infrastructure

    Aleksandr Nahapetyan, Sathvik Prasad, Kevin Childs, Adam Oest, Yeganeh Ladwig, Alexandros Kapravelos, and Bradley Reaves. On SMS Phishing Tactics and Infrastructure. In2024IEEESymposiumonSecurityand Privacy (SP), pages 169–169. IEEE Computer Society, 2024

    2024

  36. [44]

    Recent tycoon 2fa phishing campaigns target government entities

    NJCCIC. Recent tycoon 2fa phishing campaigns target government entities. NJCCIC News

  37. [45]

    PhishFarm: A Scalable Framework for Measuring the Effectiveness of EvasionTechniquesagainstBrowserPhishingBlacklists

    Adam Oest, Yeganeh Safaei, Adam Doupe, Gail-Joon Ahn, Brad Wardman, and Kevin Tyers. PhishFarm: A Scalable Framework for Measuring the Effectiveness of EvasionTechniquesagainstBrowserPhishingBlacklists. In2019 IEEE Symposium on Security and Privacy (SP), pages 1344–1361, San F...

    2019

  38. [46]

    Inside a Phisher’s Mind: Understanding the Anti-Phishing Ecosystem through Phishing Kit Analysis

    Adam Oest, Yeganeh Safei, Adam Doupe, Gail-Joon Ahn, Brad Wardman, and Gary Warner. Inside a Phisher’s Mind: Understanding the Anti-Phishing Ecosystem through Phishing Kit Analysis. In2018 APWG Symposium on Electronic Crime Research (eCrime), pages 1–12, San Diego, CA, May 2018. IEEE

    2018

  39. [47]

    Sunrise to Sunset: Analyzing the End- to-end Life Cycle and Effectiveness of Phishing Attacks at Scale

    AdamOest,PenghuiZhang,BradWardman,EricNunes, JakubBurgis,AliZand,KurtThomas,AdamDoupé,and Gail-Joon Ahn. Sunrise to Sunset: Analyzing the End- to-end Life Cycle and Effectiveness of Phishing Attacks at Scale. pages 361–377

  40. [48]

    Puppeteer stealth plugin, 2025

    Berstend on Github. Puppeteer stealth plugin, 2025

    2025

  41. [49]

    OpenPhish, 2025

    OpenPhish. OpenPhish, 2025

    2025

  42. [50]

    FV8: A Forced Execution JavaScript Engine for Detecting Evasive Techniques

    Nikolaos Pantelaios and Alexandros Kapravelos. FV8: A Forced Execution JavaScript Engine for Detecting Evasive Techniques. InProceedings of the USENIX Security Symposium, August 2024

    2024

  43. [51]

    Pedregosa, G

    F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, 15 R.Weiss,V.Dubourg,J.Vanderplas,A.Passos,D.Cour- napeau,M.Brucher,M.Perrot,andE.Duchesnay. Scikit- learn: Machine learning in Python.Journal of Machine Learning Research, ...

    2011

  44. [52]

    Chakradhara Rao, A.V.T

    Ch. Chakradhara Rao, A.V.T. Raghav Ramana, and B.Sowmya. Detectionofphishingwebsitesusinghybrid model. 2018

    2018

  45. [53]

    V-measure: A conditional entropy-based external cluster evaluation measure

    Andrew Rosenberg and Julia Hirschberg. V-measure: A conditional entropy-based external cluster evaluation measure. InConference on Empirical Methods in Natu- ral Language Processing, 2007

    2007

  46. [54]

    Rods with LaserBeams:UnderstandingBrowserFingerprintingon Phishing Pages

    Iskander Sanchez-Rola, Leyla Bilge, Davide Balzarotti, Armin Buescher, and Petros Efstathopoulos. Rods with LaserBeams:UnderstandingBrowserFingerprintingon Phishing Pages. pages 4157–4173

  47. [55]

    Hiding in Plain Site: Detecting JavaScript Obfuscation through Concealed Browser API Usage

    Shaown Sarker, Jordan Jueckstock, and Alexandros Kapravelos. Hiding in Plain Site: Detecting JavaScript Obfuscation through Concealed Browser API Usage. In Proceedings of the ACM Internet Measurement Confer- ence (IMC), page 648–661, October 2020

    2020

  48. [56]

    Urlscan, 2025

    SecurityTrails. Urlscan, 2025

    2025

  49. [57]

    kn0w thy doma1n name

    Hossein Shirazi, Bruhadeshwar Bezawada, and Indrak- shi Ray. "kn0w thy doma1n name": Unbiased phishing detection using domain name based features.Proceed- ings of the 23nd ACM on Symposium on Access Control Models and Technologies, 2018

    2018

  50. [58]

    Kiz- zle: A signature compiler for detecting exploit kits

    Ben Stock,Benjamin Livshits,and Benjamin Zorn. Kiz- zle: A signature compiler for detecting exploit kits. In 2016 46th Annual IEEE/IFIP International Conference onDependableSystemsandNetworks(DSN),pages455– 466, 2016

    2016

  51. [59]

    Automatic Discovery of Emerging Browser Fingerprinting Tech- niques

    Junhua Su and Alexandros Kapravelos. Automatic Discovery of Emerging Browser Fingerprinting Tech- niques. InProceedings of the ACM Web Conference 2023,WWW’23,page2178–2188,NewYork,NY,USA,

    2023

  52. [60]

    PhishInPatterns: measuring elicited user interactions at scale on phish- ing websites

    Karthika Subramani, William Melicher, Oleksii Starov, Phani Vadrevu, and Roberto Perdisci. PhishInPatterns: measuring elicited user interactions at scale on phish- ing websites. InProceedings of the 22nd ACM Internet Measurement Conference, IMC ’22,pages 589–604. As- sociation...

  53. [61]

    Leaky Kits: The Increased Risk of Data Exposure from Phish- ing Kits

    Bhaskar Tejaswi, Nayanamana Samarasinghe, Sajjad Pourali, Mohammad Mannan, and Amr Youssef. Leaky Kits: The Increased Risk of Data Exposure from Phish- ing Kits. In2022 APWG Symposium on Electronic Crime Research (eCrime), pages 1–13, Boston, MA, USA, November 2022. IEEE

    2022

  54. [62]

    {PhishDecloaker}: Detecting {CAPTCHA-cloaked} phishing websites via hybrid vision-based interactive models

    Xiwen Teoh, Yun Lin, Ruofan Liu, Zhiyong Huang, and Jin Song Dong. {PhishDecloaker}: Detecting {CAPTCHA-cloaked} phishing websites via hybrid vision-based interactive models. pages 505–522

  55. [63]

    Browser-in-the-middle - evaluation of a modern approach to phishing

    JonasTzschoppeandHansLöhr. Browser-in-the-middle - evaluation of a modern approach to phishing. InPro- ceedings of the 16th European Workshop on System Se- curity, EUROSEC ’23, pages 15–20. Association for Computing Machinery

  56. [64]

    Verma and Avisha Das

    Rakesh M. Verma and Avisha Das. What’s in a url: Fast feature extraction and malicious url detection.Pro- ceedings of the 3rd ACM on International Workshop on Security And Privacy Analytics, 2017

    2017

  57. [65]

    CrawlPhish: Large-scaleAnalysisofClient-sideCloakingTechniques in Phishing

    Penghui Zhang, Adam Oest, Haehyun Cho, Zhibo Sun, Rc Johnson, Brad Wardman, Shaown Sarker, Alexan- drosKapravelos,TiffanyBao,RuoyuWang,YanShoshi- taishvili,AdamDoupé,andGail-JoonAhn. CrawlPhish: Large-scaleAnalysisofClient-sideCloakingTechniques in Phishing. In2021 IEEE Sympos...

    2021

  58. [66]

    CrawlPhish: Large-scale analysis of client-side cloaking techniques in phishing

    Penghui Zhang, Adam Oest, Haehyun Cho, Zhibo Sun, RC Johnson, Brad Wardman, Shaown Sarker, Alexan- drosKapravelos,TiffanyBao,RuoyuWang,YanShoshi- taishvili,AdamDoupé,andGail-JoonAhn. CrawlPhish: Large-scale analysis of client-side cloaking techniques in phishing. In2021 IEEE S...

  59. [67]

    I’m SPAR- TACUS, No, I’m SPARTACUS: Proactively Protecting Users from Phishing by Intentionally Triggering Cloak- ing Behavior

    Penghui Zhang, Zhibo Sun, Sukwha Kyung, Hans Wal- ter Behrens, Zion Leonahenahe Basque, Haehyun Cho, Adam Oest, Ruoyu Wang, Tiffany Bao, Yan Shoshi- taishvili, Gail-Joon Ahn, and Adam Doupé. I’m SPAR- TACUS, No, I’m SPARTACUS: Proactively Protecting Users from Phishing by Inte...

    2022

  60. [2023]

    Association for Computing Machinery

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.