Phishing kit
A phishing kit is a ready-made package of pages and scripts that copies a brand's login or wallet flow and sends whatever the victim enters to the operator.
How it works
Kits are sold or shared in archives with templates, anti-bot checks and an exfiltration method (email, Telegram bot, web panel). Operators upload them to many cheap domains at once.
Shared files, paths, favicons and code fingerprints link domains built from the same kit.
Example from the PhishDestroy database
- rabbysend.site: Domain with a recorded kit label, first detected 2026-10-21.
- xam-allocation.com: Domain with a recorded kit label, first detected 2026-10-21.
- roaringkitty.fyi: Domain with a recorded kit label, first detected 2026-10-21.
How to protect yourself
- Analysts can fingerprint kits by file paths, favicon hashes and code; brands can monitor for those fingerprints.
- Report all domains of a kit together, with the shared evidence.