Lion Cipher Lab
Cluster phishing pages by HTML structure to find the shared kit
- Threat Intel Analyst
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Most credential-phishing pages are not hand-written. They come from phishing kits: zip files of ready-made pages that criminals buy, trade or download and then re-skin for each new target. Researchers who studied the Dutch phishing landscape found that almost 89% of the phishing sites they identified came from one kit family. That makes the kit one of the most useful things a threat-intel analyst can recognise: if you can say 'these 40 sites are the same kit', you can write one detection instead of forty, tell a takedown team which sites belong together, and spot the next deployment the day…
What you'll learn
- Explaining why phishing pages built from one kit share HTML structure even when brand, text, colours and names change
- Reducing an HTML page to structure tokens with Python's html.parser (tag plus sorted attribute names, values and text thrown away)
- Comparing pages with k-shingles and Jaccard similarity, and sweeping a threshold instead of guessing one
- Scoring a clustering with pairwise precision and recall against ground truth
- Adding a second, independent feature (the form's input types) to cut false merges caused by shared templates
- Normalising the noise a kit adds on purpose, and measuring how a smarter kit defeats that normalisation
- Knowing what an exact hash such as urlscan.io's dom.hash can and cannot link
Steps in this lab
- What a phishing kit is, and why 'same kit' is worth knowing
- Why content changes and structure survives
- Build the corpus: 38 inert, invented login pages
- See what 'structure' means before you trust a score built on it
- Exact hashes: the redeploy finder (and why urlscan's dom.hash behaves the same way)
- Shingles and Jaccard: sweep the threshold, then read what merged
- Add an independent feature: what the form actually asks for
- Normalise the noise the kit adds on purpose
- Break your own method: two failure modes, measured
- When to use this, and how a professional does it better