Phishing Kit Detector
by @edgeiq-labs
Detects phishing kit artifacts, brand impersonation, suspicious JavaScript, and infrastructure on URLs or local HTML to identify phishing kit clones.
clawhub install edgeiq-phishing-kit-detectorπ About This Skill
Phishing Kit Detector
Skill Name: phishing-kit-detector
Version: 1.0.0
Category: Security / Phishing / OSINT
Price: Lifetime: $39 / Optional Monthly: $7/mo (includes all Pro features permanently)
Author: EdgeIQ Labs
OpenClaw Compatible: Yes β Python 3, pure stdlib, WSL + Linux
What It Does
Detects phishing kit artifacts, brand impersonation, form action URLs, stolen branding, suspicious JavaScript, and credential harvesting infrastructure. Analyzes live URLs or local HTML dumps to determine if a page is a phishing kit clone.
> β οΈ Legal Notice: Only analyze domains you own or have explicit written authorization to audit. Not for unauthorized scanning of third-party sites.
Features
Tier Comparison
| Feature | Free | Lifetime ($39) | Optional Monthly ($7/mo) | |---------|------|----------------|----------------------| | URL scan | β (5 scans) | β (unlimited) | β (unlimited) | | Local file scan | β | β | β | | Brand impersonation check | β | β | β | | JS analysis | β | β | β | | Infrastructure fingerprinting | β | β | β | | Stolen branding detection | β | β | β | | JSON export | β | β | β |
Installation
cp -r /home/guy/.openclaw/workspace/apps/phishing-kit-detector ~/.openclaw/skills/phishing-kit-detector
Usage
Basic URL scan (free tier)
python3 phishing_detector.py --url "https://suspicious-site.com/login"
Local HTML file scan (Pro)
EDGEIQ_EMAIL=your_email@gmail.com python3 phishing_detector.py \
--file /path/to/phishing_page.html --pro
Brand impersonation check (Pro)
python3 phishing_detector.py --url "https://fake-paypal.com" \
--brands paypal,amazon,apple --pro
Full bundle analysis + JSON export
EDGEIQ_EMAIL=your_email@gmail.com python3 phishing_detector.py \
--url "https://phishing-site.net" --bundle --output report.json
Parameters
| Flag | Type | Default | Description |
|------|------|---------|-------------|
| --url | string | β | Phishing URL to analyze |
| --file | string | β | Path to local HTML file |
| --brands | string | β | Comma-separated brand list (paypal,amazon,apple,google,microsoft,facebook,instagram,twitter,netflix,linkedin) |
| --pro | flag | False | Enable Pro features |
| --bundle | flag | False | Enable Bundle features |
| --output | string | β | Write JSON report to file |
Brand List
Supported brands for impersonation detection:
paypal Β· amazon Β· apple Β· google Β· microsoft Β· facebook Β· instagram Β· twitter Β· netflix Β· linkedin Β· ebay Β· salesforce Β· dropbox Β· slack Β· zoom Β· steam Β· epic games Β· steam Β· yahoo Β· cnn Β· chase Β· bank of america Β· wells fargo Β· capital one
Output Example
=== Phishing Kit Detector ===
Analyzing: https://fake-paypal.com/account/verify π΄ PHISHING KIT DETECTED (98% confidence)
Artifact Analysis:
Form action β credential harvest endpoint detected
Hidden field β password re-entry field (credential capture)
Credential autocomplete β enabled on sensitive fields
Multiple forms β login + payment + PIN entry
Brand Impersonation:
Detected: PayPal (logo, CSS framework, brand colors)
Stolen assets: 3 CSS files, 2 images from paypal.com
Fake SSL badge detected
Infrastructure:
Free hosting provider detected (Freenom .tk domain)
Suspicious TLD: .tk β commonly used in phishing
Redirect chain: 2 hops before landing page
Shared hosting IP β multiple malicious sites on same IP
JavaScript Findings:
Credential harvester script detected
Keylogger injection found
Redirect to: paypal.com.legit-site.ru
Threat Level: CRITICAL β Sophisticated phishing kit with credential harvesting + keylogger
Pro Upgrade
Full phishing kit analysis + brand impersonation + JS analysis + infrastructure fingerprinting:
π Buy Lifetime β $39 π Subscribe Monthly β $7/mo
Support
Open a ticket in #edgeiq-support or email gpalmieri21@gmail.com
π More from EdgeIQ Labs
edgeiqlabs.com β Security tools, OSINT utilities, and micro-SaaS products for developers and security professionals.
π‘ Examples
Basic URL scan (free tier)
python3 phishing_detector.py --url "https://suspicious-site.com/login"
Local HTML file scan (Pro)
EDGEIQ_EMAIL=your_email@gmail.com python3 phishing_detector.py \
--file /path/to/phishing_page.html --pro
Brand impersonation check (Pro)
python3 phishing_detector.py --url "https://fake-paypal.com" \
--brands paypal,amazon,apple --pro
Full bundle analysis + JSON export
EDGEIQ_EMAIL=your_email@gmail.com python3 phishing_detector.py \
--url "https://phishing-site.net" --bundle --output report.json