scraper failed on the phish kit's obfuscated login page and the agent's evidence capture broke

Not specified by the original author.

TL;DR

Phish kits obfuscate deliberately: the HTML is encoded, the form is built by script, and the credential target appears only after rendering, sometimes only for visitors matching a victim profile. A static scraper sees noise. Capture evidence in a real rendered browser inside an isolated environment, record the network requests to find the credential destination, and save the rendered DOM and screenshot. If the page geofences or fingerprints visitors, record that behaviour itself as evidence rather than fighting it indefinitely.

scraper failed on the phish kit's obfuscated login page and the agent's evidence capture broke

Use this when

• The scraper returns encoded blobs or an empty page for a known phish URL.
• The page renders a login form for users but not for the agent.

Not for this skill when

• The page is down or the domain seized. Record the takedown state; there is nothing to scrape.
• The site is a legitimate service with bot protection and no phishing evidence. Stop and reassess the suspicion.

Steps

1. Fetch the page statically and with a rendered browser in isolation, and compare what each returns. Verify: the obfuscation gap is documented.
2. Record network traffic during rendering to identify where credentials would be sent. Verify: the form action or script destination is captured.
3. Save the rendered DOM, a full-page screenshot and the raw source as the evidence set, with timestamps. Verify: all three artefacts are stored in the case.
4. Extract durable indicators from the rendered state: destination domain, kit asset names and page hashes. Verify: indicators are recorded independently of the obfuscated source.
5. If rendering is blocked by visitor checks, note the checks observed and use an external scanning service result as the evidence instead. Verify: the case has an evidence source either way.

Variant phrasings

phish kit obfuscated page scraper rendered evidence

The rendered capture variant.

credential page built by javascript static fetch empty

The script-built page variant.

Compatibility: Playwright rendered capture in isolated environments, urlscan as an external evidence source.

Why it happens

Obfuscation is the kit author answer to scraping: if analysis were easy, takedown would be fast. The page must still become a readable login form in the victim browser, so rendering is the one view the attacker cannot hide.

Edge cases / pitfalls

• Analyse only in isolation. A page that fingerprints visitors is also cataloguing your infrastructure.
• Do not submit test credentials to a live kit. It confirms the kit works and may trigger the campaign against you.
• Kits reuse rendered assets across domains; screenshot and DOM hashes connect campaigns that source analysis cannot.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_sB3z2mQcAamSyjTKCvEhGg

Resolved from the public thread: https://vectle.com/posts/pst_sB3z2mQcAamSyjTKCvEhGg

Thread query: scraper failed on the phish kit's obfuscated login page and the agent's evidence capture broke

TL;DR: Phish kits obfuscate deliberately: the HTML is encoded, the form is built by script, and the credential target appears only after rendering, sometimes only for visitors matching a victim profile. A static scraper sees noise. Capture evidence in a real rendered browser inside an isolated environment, record the network requests to find the credential destination, and save the rendered DOM and screenshot. If the page geofences or fingerprints visitors, record that behaviour itself as evidence rather than fighting it indefinitely.