{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2025:YXWEGC4XOWRVWOBRTOU2I5BBQB","short_pith_number":"pith:YXWEGC4X","schema_version":"1.0","canonical_sha256":"c5ec430b9775a35b38319ba9a4742180574f7425d853cbd751933d48807941df","source":{"kind":"arxiv","id":"2509.13186","version":2},"attestation_state":"computed","paper":{"title":"Characterizing Phishing Pages by JavaScript Capabilities","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Aleksandr Nahapetyan, Alexandros Kapravelos, Bradley Reaves, Kanv Khare, Kevin Schwarz","submitted_at":"2025-09-16T15:39:23Z","abstract_excerpt":"Phishers achieve large-scale attacks by using ready-to-deploy phishing websites (phishing kits) to rapidly launch campaigns that leverage specific data exfiltration, evasion, or mimicry techniques. In contrast, researchers and defenders continue to rely on manual analysis to identify features for kit fingerprinting. In this paper, we examine the link between a page's client-side behavior and the underlying phishing kit used, enabling automated aggregation of phishing pages. Our key insight is that client-side techniques make heavy use of browser APIs, which, in turn, differentiate underlying k"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2509.13186","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2025-09-16T15:39:23Z","cross_cats_sorted":[],"title_canon_sha256":"fd6555a3b8486e40b48bfe2c2b8bb0a66009cf03ffb8c36646531b9bf8fd4a18","abstract_canon_sha256":"478c956b4d65782ab54d7004dfd33f57234cbe210b4b0a964a6c8ba1fa8afb5c"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-20T01:18:20.197537Z","signature_b64":"YBfKhsQ3yc1t9Igs8dQrVnk3yu4LmmpQjXCiwJvlNCfsQmRCvAlC4P43sUOxutdKu8eRms6iTokqgS71znC9BQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c5ec430b9775a35b38319ba9a4742180574f7425d853cbd751933d48807941df","last_reissued_at":"2026-07-20T01:18:20.196502Z","signature_status":"signed_v1","first_computed_at":"2026-07-20T01:18:20.196502Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Characterizing Phishing Pages by JavaScript Capabilities","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Aleksandr Nahapetyan, Alexandros Kapravelos, Bradley Reaves, Kanv Khare, Kevin Schwarz","submitted_at":"2025-09-16T15:39:23Z","abstract_excerpt":"Phishers achieve large-scale attacks by using ready-to-deploy phishing websites (phishing kits) to rapidly launch campaigns that leverage specific data exfiltration, evasion, or mimicry techniques. In contrast, researchers and defenders continue to rely on manual analysis to identify features for kit fingerprinting. In this paper, we examine the link between a page's client-side behavior and the underlying phishing kit used, enabling automated aggregation of phishing pages. Our key insight is that client-side techniques make heavy use of browser APIs, which, in turn, differentiate underlying k"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.13186","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2509.13186/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2509.13186","created_at":"2026-07-20T01:18:20.196958+00:00"},{"alias_kind":"arxiv_version","alias_value":"2509.13186v2","created_at":"2026-07-20T01:18:20.196958+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.13186","created_at":"2026-07-20T01:18:20.196958+00:00"},{"alias_kind":"pith_short_12","alias_value":"YXWEGC4XOWRV","created_at":"2026-07-20T01:18:20.196958+00:00"},{"alias_kind":"pith_short_16","alias_value":"YXWEGC4XOWRVWOBR","created_at":"2026-07-20T01:18:20.196958+00:00"},{"alias_kind":"pith_short_8","alias_value":"YXWEGC4X","created_at":"2026-07-20T01:18:20.196958+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/YXWEGC4XOWRVWOBRTOU2I5BBQB","json":"https://pith.science/pith/YXWEGC4XOWRVWOBRTOU2I5BBQB.json","graph_json":"https://pith.science/api/pith-number/YXWEGC4XOWRVWOBRTOU2I5BBQB/graph.json","events_json":"https://pith.science/api/pith-number/YXWEGC4XOWRVWOBRTOU2I5BBQB/events.json","paper":"https://pith.science/paper/YXWEGC4X"},"agent_actions":{"view_html":"https://pith.science/pith/YXWEGC4XOWRVWOBRTOU2I5BBQB","download_json":"https://pith.science/pith/YXWEGC4XOWRVWOBRTOU2I5BBQB.json","view_paper":"https://pith.science/paper/YXWEGC4X","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2509.13186&json=true","fetch_graph":"https://pith.science/api/pith-number/YXWEGC4XOWRVWOBRTOU2I5BBQB/graph.json","fetch_events":"https://pith.science/api/pith-number/YXWEGC4XOWRVWOBRTOU2I5BBQB/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/YXWEGC4XOWRVWOBRTOU2I5BBQB/action/timestamp_anchor","attest_storage":"https://pith.science/pith/YXWEGC4XOWRVWOBRTOU2I5BBQB/action/storage_attestation","attest_author":"https://pith.science/pith/YXWEGC4XOWRVWOBRTOU2I5BBQB/action/author_attestation","sign_citation":"https://pith.science/pith/YXWEGC4XOWRVWOBRTOU2I5BBQB/action/citation_signature","submit_replication":"https://pith.science/pith/YXWEGC4XOWRVWOBRTOU2I5BBQB/action/replication_record"}},"created_at":"2026-07-20T01:18:20.196958+00:00","updated_at":"2026-07-20T01:18:20.196958+00:00"}