Phishing Kit Analysis: Investigating Attacker Infrastructure After a Targeted Phishing Email
Retool's new app builder is where AI-generated code ships safely
Building apps with AI is easy. Getting them to production safely is another story.
Most organizations respond to a phishing email by deleting it and warning employees. The more valuable response is to treat the phishing email as an intelligence collection opportunity — the attacker invested resources in the infrastructure, and analyzing that infrastructure yields: the list of employees who were targeted, the list of employees who clicked the link, evidence of whether credentials were submitted, and IOCs for blocking the campaign across all security controls.
Phishing kit analysis is not a specialized forensics capability. The workflow uses freely available tools (urlscan.io, VirusTotal, WHOIS, Shodan) and requires about an hour for a competent analyst to complete. The output is specific, actionable intelligence that passive deletion cannot produce.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
The analysis workflow: safe examination without tipping off the attacker
The order of analysis matters because phishing kits include anti-analysis techniques that detect corporate and research IP ranges and redirect them to the legitimate site rather than the phishing page. Starting with passive tools like urlscan.io means the scan originates from infrastructure the attacker has not blocked, making it more likely to retrieve the actual phishing content. From the urlscan.io results, you can identify the brand being spoofed, all resources the page loads, and the form action URL that reveals the credential collection endpoint — without any connection from your network. Only after exhausting passive analysis tools should you move to active examination from an isolated cloud VM with a fresh IP that cannot be attributed to your organization.
Start with urlscan.io — passive, no attribution to your IP
Submit the phishing URL to urlscan.io before any other analysis. The scan captures a full browser render of the phishing page, all network connections made by the page, and the full DOM including any embedded JavaScript. Review the scan output for: the brand being impersonated (is it your organization's login page? A partner's? A bank?), any redirects that obscure the final landing page, external scripts loaded from attacker-controlled servers, and form action URLs that reveal where credentials are submitted. The urlscan.io screenshot is also useful for legal documentation and abuse reports to hosting providers. Most phishing pages serve different content to known security researcher IPs — urlscan.io's infrastructure is not on attacker blocklists, making it more likely to retrieve the actual phishing page than a direct visit from a known corporate or security research IP.
Extract the credential collection endpoint for targeted blocking
The most actionable single IOC from phishing analysis is the credential collection endpoint URL — the POST target where the phishing form submits credentials. In urlscan.io: look at the 'HTTP Transactions' tab for POST requests to PHP scripts. In the kit source: find the form action attribute in the HTML: <form action='post.php' method='POST'> reveals the collection script name. In a downloaded kit: read the collection PHP file to determine whether credentials are emailed (mail() function with attacker email), written to a local file (file_put_contents()), or forwarded to Telegram (API call to api.telegram.org). Blocking this specific URL path at your web proxy prevents credential submission even if a user reaches the phishing page.
The bottom line
Phishing kit analysis converts a passive security event into active threat intelligence. The analysis workflow — urlscan.io for safe initial examination, kit download in an isolated environment, credential collection endpoint extraction, infrastructure pivot via WHOIS and IP analysis, and employee exposure search in email and proxy logs — takes one to two hours and produces specific IOCs for blocking, a list of employees who may have been targeted, and takedown evidence for hosting providers. Submit IOCs to the SIEM, email security platform, and web proxy before considering the incident closed. The same infrastructure is frequently reused across multiple campaigns; the intelligence you develop today may accelerate detection and response to the next campaign.
Frequently asked questions
What is the safe workflow for analyzing a phishing URL without revealing my IP to the attacker?
Safe phishing URL analysis workflow (in this order): (1) Submit to urlscan.io: go to urlscan.io, enter the phishing URL, and use the 'public' scan option. urlscan.io's servers visit the URL, render the page, and capture: a screenshot of the rendered page, all DNS lookups, all HTTP requests made by the page (scripts, images, iframes), the final resolved URL after redirects, and server certificate details. This reveals the page content and infrastructure without any connection from your IP. (2) Check VirusTotal: search the URL in VirusTotal for existing intelligence — if the URL was previously submitted by other researchers, you may find the detection status across 80+ security vendors and community comments. (3) Check URLhaus and PhishTank: look up the domain in URLhaus (abuse.ch) and PhishTank to see if the infrastructure has been reported by other organizations. (4) Review the urlscan.io output: examine the screenshot (what brand is being spoofed?), the DOM content (does it include data collection forms?), and the linked resources (any external JavaScript or PHP endpoints). (5) Only after completing steps 1-4: if you need to download the kit for deeper analysis, use a dedicated analysis VM with a non-corporate IP (a VPN or cloud VM with a fresh IP that cannot be linked to your organization).
How do I extract the phishing kit and examine it for attacker intelligence?
Phishing kit extraction and analysis: (1) Identify the kit URL: phishing kits are often packaged as ZIP files at a URL like https://phishing-domain.com/kit.zip or accessible as a directory listing. Check if the phishing page URL has a parent directory that lists files. (2) Download the kit in an isolated environment: use a fresh cloud VM (AWS EC2, DigitalOcean) with a new IP that cannot be linked to your organization. curl -O https://phishing-domain.com/kit.zip. (3) Extract and examine the PHP collection scripts: find files with common credential collection names: find . -name 'post.php' -o -name 'submit.php' -o -name 'log.php'. Open these files and look for: (a) mail() functions with the attacker's collection email address as the recipient, (b) Telegram bot tokens in API calls (common pattern: api.telegram.org/bot{TOKEN}/sendMessage), (c) file_put_contents() calls writing to a local log file. (4) Check for anti-analysis code: look for functions that check the visitor's IP against blocklists, check user-agent strings, or check geographic location. These explain why the phishing page may have appeared legitimate when clicked from your corporate network.
What IOCs should I extract from phishing infrastructure for blocking?
IOC extraction checklist for phishing infrastructure: (1) Domain IOCs: the phishing domain (including all subdomains used). Related domains registered by the same entity (pivot via WHOIS registrant email or nameserver). Typosquatted variants of your organization's domain. (2) IP IOCs: the hosting IP of the phishing server. Any IPs in the kit's PHP mailer configuration. IP ranges of the hosting provider (useful for blocking in high-risk environments). (3) URL IOCs: the specific phishing URL (including path, not just domain). The credential collection endpoint URL (post.php etc.) — blocking this at the proxy level breaks credential submission even if the phishing page loads. (4) Email IOCs: the attacker's collection email address from the PHP mailer code. The sending email address of the phishing campaign. Email headers from the phishing message (SPF/DKIM domain, sending mail server IP). (5) Infrastructure pattern IOCs: nameservers, registrars, and hosting providers commonly used by the threat actor — useful for threat hunting in future campaigns.
How do I search for other employees who may have been targeted or clicked the phishing link?
Post-phishing-analysis employee exposure search: (1) Email gateway search: search your email security platform (Microsoft Defender for Office 365, Proofpoint, Mimecast) for all emails from the phishing sender address, the phishing domain, and any related domains identified in the infrastructure analysis. Review the recipient list — every recipient is a potential victim. (2) Web proxy / DNS logs: search for access to the phishing domain and the credential collection endpoint URL in your web proxy or DNS logs for the 24-48 hours following the phishing campaign's send time. Any employee who visited the URL is a potential credential compromise. (3) Email link click tracking: many email security platforms track link clicks within emails — search for clicks on the phishing URL across all recipients. (4) Okta/Entra ID authentication logs: for each employee who clicked the phishing link, check for: new device logins, geographically unusual logins, MFA prompts at unusual times, and consent grants (OAuth consent phishing). (5) Password reset: for any employee confirmed to have submitted credentials on the phishing page — treat this as a confirmed credential compromise and initiate password reset and session revocation immediately.
How do I identify related phishing infrastructure targeting my organization?
Infrastructure pivot analysis to find related phishing assets: (1) WHOIS registrant pivot: look up the phishing domain in WHOIS (whois.domaintools.com or viewdns.info). Note the registrant email address, registrant name, and nameservers. Search for other domains registered by the same email address using Domaintools Iris, SecurityTrails, or WHOIS history services. Attackers who register multiple phishing domains often reuse registrant details. (2) Nameserver pivot: if the phishing domain uses an unusual nameserver, search for other domains using the same nameserver. Many phishing campaigns use a small set of DNS infrastructure for multiple domains. (3) IP pivot: look up the phishing server IP in Shodan or Censys. Check what other domains point to the same IP (reverse DNS lookup). (4) SSL certificate pivot: phishing sites using Let's Encrypt certificates often have a Subject Alternative Name (SAN) list that includes other domains on the same certificate. Check the certificate in Censys or crt.sh for related domains. (5) URLscan.io community feed: search urlscan.io for your organization's brand name — security researchers who scanned phishing pages impersonating your brand may have already documented related infrastructure.
What should I report to hosting providers and registrars to take down phishing infrastructure?
Phishing takedown report content: (1) Hosting provider (submit to their abuse address): the specific URL, a screenshot of the phishing page showing it impersonates your brand/domain, your organization's name and the legitimate domain being spoofed, your contact information, and the request to suspend the account hosting the phishing content. Most hosting providers have a stated response time of 24-48 hours for abuse reports. (2) Domain registrar: submit to the registrar's abuse contact with: the phishing domain, evidence of phishing (screenshot), the legitimate brand being spoofed, and a request for domain suspension. ICANN maintains an abuse contact lookup at lookup.icann.org. (3) Google Safe Browsing: report phishing URLs at safebrowsing.google.com/safebrowsing/report_phish/ — this adds the URL to Chrome, Firefox, and Safari's phishing protection databases and affects all users globally. (4) Microsoft SmartScreen: report at microsoft.com/en-us/wdsi/support/report-unsafe-site — affects Edge and Microsoft security products. (5) PhishTank: submit to phishtank.com to contribute to the community database. (6) Your email security vendor: most enterprise email security platforms (Proofpoint, Mimecast, Defender) have an analyst portal where you can submit phishing samples for faster detection across all customers.
How do I add phishing IOCs to my SIEM and email security to block the campaign?
Phishing IOC operationalization: (1) Email security blocklist: add the phishing sender domain and IP to your email security platform's block list. In Microsoft Defender for Office 365: Threat Policies > Anti-Phishing > Blocked senders. In Proofpoint: Policies > Email Authentication > Block list. (2) Web proxy / DNS blocking: add the phishing domain and credential collection endpoint URL to your web proxy blocklist. In Zscaler: Policy > Custom URL Categories > add domain to 'Phishing' category. In Cloudflare Gateway: Gateway > Firewall Policies > DNS > add domain to blocked list. (3) SIEM detection rule: create a SIEM rule that alerts if any internal host resolves or connects to the phishing domain or its IP, going back 48 hours from the time of analysis (historical hunt) and going forward until the campaign is resolved. (4) Block credential submission endpoint specifically: if your proxy has URL path filtering, block the specific path of the credential collection endpoint (e.g., /post.php on the phishing domain) — this breaks the credential harvesting even if the phishing page loads for a user who bypasses the domain block.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
Win a $2,495 Black Hat pass.
Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.