Intercept.io

Indicator Of Kit

The commercial rules we want to highlight:

We analyzing hundreds of gigs of phishing kits

Have a team hand crafting and retro hunting rules

Information templates for hundreds of parked page providers

Browse The Rules

Open source detection rules for phishing site techniques, kits, and threat actors

Simple: based on Sigma, a simple detection rules language 🚀

Rich metadata: rules have descriptions, tags, and links to blog posts or related rules.

Information Signatures

Parked Page Detection

GoDaddy

Epik

Easyname

NameCheap

Pair Domains

WIX

Default Page Detection

CPanel

Plesk

Link Shortners

Bit.ly

Takedown Action

Interstitials:

Cloudflare

Blogger Interstitials

Suspended Panels:

CPanel

Plesk

Suspended Free Services:

github

000webhost

netlify

squaresite

weebly

webflow.io

Detection Levels

Status

Description

Examples

Confirmed Malicious

Specific known-bad phishing kits

A brand target phishing kit sold on Telegram

Likely Malicious

Known phishing kit code / platforms (not attributable to a specific brand)

reCAPTCHA API keys re-used across phishing sites

Potentially Malicious

Tactics associated with phishing sites

Evidence page was cloned using HTTrack Website Copier

Informational

Interpreting common signals to aid automatic investigations

Parked Page, Default Page, Takedown Pages

Confirmed Safe

Known-good infrastructure

Legit Microsoft SaaS infrastructure

Request a Demo

Get Started

Request a Demo

Get Started

Request a Demo

Get Started

Intercept.io

Twitter / X

Products

Takedowns

Kill Switch

Indicator Of Kit

Company

About Us

Career

Help

FAQ's

Terms & Conditions

Intercept.io

Twitter / X

Products

Takedowns

Kill Switch

Indicator Of Kit

Company

About Us

Career

Help

FAQ's

Terms & Conditions

Intercept.io

Twitter / X

Products

Takedowns

Kill Switch

Indicator Of Kit

Company

About Us

Career

Help

FAQ's

Terms & Conditions