Phishing kit

A phishing kit is a packaged set of HTML pages, images, scripts and settings that recreates a brand's login or payment flow and sends whatever victims type to the attacker. Kits are sold and shared on criminal forums and messaging channels, so a single kit can sit behind many separate phishing sites at once.

How it works

The operator uploads the kit, usually as a ZIP archive, to a compromised website or cheap hosting, points a domain at it and starts sending links by email, SMS or ads. A typical kit contains:

• copies of the brand's pages, logos and stylesheets;
• a script that forwards submitted data to an email address, a Telegram bot or a remote panel;
• filters that block known security crawlers, a form of cloaking;
• sometimes extra steps that ask for one-time codes, card details or ID photos.

Because the same code is reused, identical file names, folder paths and text strings tend to show up across many sites.

Example

In an illustrative case, a kit imitating a bank's online banking login is found on examplebank-login[.]com and, a week later, on examplebank-verify[.]net. Both use the folder /secure/auth/, the same typo in the footer and the same script name. Once the first copy has been analysed, the second can be recognised and reported much faster.

How to spot it

• A page that copies your site almost exactly but lives on an unrelated domain.
• Leftover archive files such as .zip in open directories on the same host.
• Login forms that post to unusual endpoints, including messaging-app bot APIs.
• Identical paths, file names or code comments across several suspicious domains.
• Pages that load normally for visitors but return errors to scanners.

What brands can do

Treat every live copy as its own incident: capture evidence, then report it to the hosting provider, the registrar and blocklists such as Google Safe Browsing. Keep a record of kit fingerprints, because they help you recognise new deployments quickly. Watching certificate transparency logs and newly registered domains shortens the time between deployment and detection. Phishvoid's team verifies these sites and files the takedowns; you can contact us if a kit is targeting your brand.

Read more: How to Spot a Phishing Website: 10 Warning Signs