Anatomy of a phishing kit

Template, not a real report. Every indicator below uses IANA-reserved documentation ranges (RFC 5737 / example.com) so nothing here resolves or points at real infrastructure. Swap in genuine findings whenever you publish your first real writeup — this exists to show the shape a report should take.

Summary

A credential-harvesting kit impersonating a login portal, distributed via email with a PDF attachment linking to a lookalike domain. The kit fingerprints visitors and redirects automated scanners to a benign page, which is the detail worth building a hunt around.

Indicators

type	value	notes
domain	login-secure-update[.]example	lookalike, registered <30 days before use
domain	cdn-assets-update[.]example	hosts kit JS/CSS
ip	203.0.113.42	hosting, shared with ~12 other lookalike domains
ip	198.51.100.17	SMTP relay used for delivery
sha256	REPLACE_WITH_REAL_HASH	landing page JS bundle

Techniques (MITRE ATT&CK)

id	technique
T1566.001	Phishing: spearphishing attachment
T1204.002	User execution: malicious file
T1583.001	Acquire infrastructure: domains
T1185	Browser session hijacking (credential capture)

Detection & hunting notes

This is the section that actually helps another defender. Be specific: a string to grep for in proxy logs, a JA3/JA3S fingerprint, a registrar pattern, a TLS certificate issuer used across the cluster, a delay-based anti-sandbox check in the kit's JS. A vague "block these IOCs" is far less useful than "here's the pivot that finds the next ten domains in this cluster."

Sources

[ List where this came from — a sandbox run, a tip, passive DNS, a takedown report you read. Cite specifically; it's what makes a writeup verifiable rather than just asserted. ]