Characterizing Phishing Pages by JavaScript Capabilities (2509.13186v1)

Abstract: In 2024, the Anti-Phishing Work Group identified over one million phishing pages. Phishers achieve this scale by using phishing kits -- ready-to-deploy phishing websites -- to rapidly deploy phishing campaigns with specific data exfiltration, evasion, or mimicry techniques. In contrast, researchers and defenders continue to fight phishing on a page-by-page basis and rely on manual analysis to recognize static features for kit identification. This paper aims to aid researchers and analysts by automatically differentiating groups of phishing pages based on the underlying kit, automating a previously manual process, and enabling us to measure how popular different client-side techniques are across these groups. For kit detection, our system has an accuracy of 97% on a ground-truth dataset of 548 kit families deployed across 4,562 phishing URLs. On an unlabeled dataset, we leverage the complexity of 434,050 phishing pages' JavaScript logic to group them into 11,377 clusters, annotating the clusters with what phishing techniques they employ. We find that UI interactivity and basic fingerprinting are universal techniques, present in 90% and 80% of the clusters, respectively. On the other hand, mouse detection via the browser's mouse API is among the rarest behaviors, despite being used in a deployment of a 7-year-old open-source phishing kit. Our methods and findings provide new ways for researchers and analysts to tackle the volume of phishing pages.

• The paper introduces a dynamic crawling infrastructure that leverages JavaScript API execution traces to effectively cluster phishing pages and differentiate kits.
• The clustering approach achieved 97 FMI accuracy and 91 V-measure, outperforming traditional static methods with a scalable, unsupervised technique.
• The analysis links specific API calls to phishing techniques, providing actionable insights for future threat intelligence and detection strategies.

Characterizing Phishing Pages by JavaScript Capabilities

Introduction

This paper presents a comprehensive methodology for the automated characterization and clustering of phishing pages based on their client-side JavaScript behaviors, specifically focusing on browser API usage. The approach leverages dynamic analysis to differentiate phishing kits, moving beyond traditional static feature-based methods. By analyzing execution traces from over 950,000 phishing pages, the authors demonstrate that browser API usage is a robust signal for kit identification, achieving high accuracy and enabling large-scale measurement of adversarial techniques in the phishing ecosystem.

Methodology and Data Collection

The core of the methodology is a dynamic crawling infrastructure that collects execution traces of JavaScript APIs from phishing pages. URLs are sourced from multiple feeds (OpenPhish, PhishTank, URLScan, SMS Gateways, PhishDB, APWG) and processed using a patched Chromium browser (VisibleV8) to log all browser API calls. KitPhishr is employed to identify and collect phishing kits directly from compromised servers, providing ground truth for kit-to-URL mappings.

Figure 1: Overview of the crawling and clustering infrastructure used to collect and process phishing page data.

Execution traces are post-processed to isolate first-party API calls, and kits are deduplicated using SHA256 hashes and Jaccard similarity of source files. The clustering of pages is performed using HDBSCAN with Jaccard distance over API sets, allowing for unsupervised grouping without prior knowledge of cluster counts.

Clustering and Kit Identification

The clustering approach is validated against a ground truth dataset of 548 kit families and 4,562 URLs. The authors report an FMI-based accuracy of 97 and a V-measure of 91, substantially outperforming prior work that relied on DOM or URL path-based signatures. The methodology is scalable, with clustering performed on rolling windows to manage the computational demands of large distance matrices.

Figure 2: Monthly comparison of unique domains versus clusters observed, illustrating the reduction in phenomena requiring investigation.

Figure 3: Distribution of silhouette scores for local clusters, indicating well-separated and well-formed clusters.

The analysis reveals that browser API sets are more effective than script hashes for kit differentiation, even when accounting for dynamically extracted scripts. DOM APIs and property reads are particularly valuable signals, reflecting kit authors' choices in UI libraries and evasion strategies.

Characterization of Phishing Techniques

The authors map browser APIs to specific phishing techniques, including fingerprinting, client-side IP checks, timing-based bot detection, obfuscation, dynamic script creation, and pop-up usage. Clusters are annotated with these techniques based on the presence of corresponding API calls.

Figure 4: t-SNE embedding of distance matrix between pages, visualizing cluster separation for Ethereum wallet and open-source kit variants.

UI interactivity and basic fingerprinting are nearly universal, present in 91% and 80% of clusters, respectively. Advanced fingerprinting is observed in 69% of clusters. In contrast, obfuscation, dynamic script creation, and bot detection are less common, with only 21% of clusters employing obfuscation and 15,980 pages dynamically generating script elements.

Figure 5: Validity measure for clusters as a function of minimum distinct APIs required, demonstrating the trade-off between cluster quality and coverage.

Client-side IP reputation checks are present in 504 clusters, utilizing 15 unique APIs to evade detection by redirecting away from cloud, CDN, and educational networks. Pop-up APIs are declining in usage, likely due to browser changes that reduce their effectiveness for cloaking.

Figure 6: Example of a phishing page embedding Cloudflare Turnstile verification on a non-Cloudflare domain.

Mouse detection APIs and Cloudflare Turnstile embedding are rare, found in only a handful of clusters, often associated with older open-source kits or high-value phishing campaigns. The ecosystem exhibits both adoption of cutting-edge APIs (e.g., NavigatorUAData.getHighEntropyValues, WebAssembly) and continued use of deprecated APIs.

Figure 7: Confusion matrix of techniques versus cluster lifetime characteristics, showing technique prevalence across cluster sizes and durations.

Ecosystem Insights and Brand Mimicry

Analysis of brand targeting reveals that 69% of clusters are associated with a single brand, indicating increasing brand specificity in kit deployments. However, the similarity between phishing pages and their target brands, as measured by API usage, is low (average 11%), suggesting that kit authors prioritize evasion and credential harvesting over faithful mimicry of target sites.

Figure 8: Histogram of unique brand labels per cluster, highlighting the predominance of single-brand clusters.

Figure 9: Cropped screenshots from a multi-lingual phishing cluster targeting Microsoft Defender, demonstrating deployment diversity.

Figure 10: Timeline of the top 10 clusters by page count, illustrating the persistence and evolution of major kit deployments.

Implications and Future Directions

The findings have significant implications for both research and operational defense. Automated behavioral clustering enables scalable analysis of the phishing ecosystem, facilitating rapid identification of kit families and measurement of technique prevalence. The approach provides a foundation for threat intelligence sharing and more effective countermeasures, as analysts can aggregate pages by kit and infer associated evasion and exfiltration strategies.

Theoretically, the work demonstrates the utility of dynamic analysis and behavioral aggregation for malware and phishing research, suggesting that similar methodologies could be extended to other web-based threats. The observed trends in API usage and technique adoption inform future detection strategies, emphasizing the need for dynamic, interaction-aware crawlers and continuous monitoring of emerging browser capabilities.

Conclusion

This paper establishes browser API execution traces as a robust and scalable signal for clustering and characterizing phishing pages by their underlying kits and techniques. The methodology achieves high accuracy in kit identification and provides detailed insights into the prevalence and evolution of adversarial behaviors in the phishing ecosystem. The results support the adoption of dynamic, behavior-based analysis for both research and operational defense, with future work likely to focus on deeper interaction modeling and real-time threat intelligence integration.