kitphishr

Hunt phishing kits in the wild, and extract attacker intelligence from what you capture.

kitphishr scans suspected phishing URLs for exposed kit archives — open directories, predictable filenames, redirect-handled paths — and produces structured intelligence about each kit it captures, including the attacker's mail drops, Telegram bot tokens, and Discord webhooks. It is built for blue teams, security researchers, and threat-intelligence providers who need to know where phishing campaigns are landing victim data.

• Two subcommands. kitphishr scans URLs for kits; kitphishr analyze extracts attacker indicators and classifies the impersonated brand from captured kits.
• Built-in threat feeds. Pulls fresh URLs from several open-source phishing feeds (PhishTank, OpenPhish, PhishStats, Phishing.Database, phishunt.io, TweetFeed, and 0xDanielLopez's kit archives) — or accept a custom URL list on stdin. See Sources for the full, always-current list.
• Polite by default. Per-host rate limiting, retry with exponential backoff, and graceful Ctrl-C handling.
• Structured output. JSONL records with SHA256-keyed deduplication and source-feed provenance, designed to stream into Elastic, Splunk, MISP, or any TI pipeline.
• Configurable hunting. Supply your own wordlists and extension sets to target specific kit naming conventions.

go install github.com/cybercdh/kitphishr@latest

Requires Go 1.25 or later.

# Hunt for kits using built-in threat feeds, save what you find
kitphishr -d -o ./kits

# Hunt against your own URL list
cat urls.txt | kitphishr -d -v -o ./kits

# Extract attacker indicators from captured kits
ls kits/*.zip | kitphishr analyze -o intel.jsonl

Each saved kit appends a JSONL record to kits/index.jsonl:

{"ts":"2026-06-03T12:00:00Z","url":"https://attacker.com/kit.zip","sha256":"a4b...","size":102400,"content_type":"application/zip","source":"openphish","saved_path":"kits/a4b....zip"}

kitphishr analyze produces records like:

{"path":"kits/a4b....zip","sha256":"a4b...","size":102400,"files_scanned":17,"brands":[{"name":"Microsoft","hits":42}],"emails":["drop@attacker.ru","backup@attacker.ru"],"telegram_bots":["5234567890:AAE..."],"telegram_chat_ids":["987654321"],"discord_webhooks":["https://discord.com/api/webhooks/..."]}

Identical kits captured at different URLs are deduplicated by SHA256 — one file on disk, N entries in the index.

kitphishr pulls candidate URLs from the open-source phishing feeds below. Each feed is declared in internal/sources with its provenance tag, homepage, and license; the table is generated from that registry and verified in CI, so it always reflects the feeds that are actually enabled.

Licensing: several feeds restrict commercial use of their URL lists (see the Commercial use column). For a commercial deployment, prefer the commercial-safe subset. This concerns the feeds' URL data, not kitphishr's own license (below).

Targets can be passed as arguments or piped via stdin.

PhishTank rate-limits anonymous feed access. If you have a free API key, export it and kitphishr will use it automatically:

export PT_API_KEY=<your_key>

kitphishr is dual-licensed:

• Open use — security research, internal blue-team and SOC work, education, academic projects — is free under GPLv2 with project-specific clarifications. See LICENSE.
• Commercial integration — embedding kitphishr into a product, threat-intelligence platform, SaaS offering, or appliance — requires a commercial license. Contact cybercdh@gmail.com.

A plain-English explainer with a quick-reference table for common use cases is in LICENSING.md.

Pull requests are welcome. See CONTRIBUTING.md for the lightweight inbound terms.

Several Go idioms in this project come from @tomnomnom's meg. The original idea was inspired by Duo Labs' phish-collect research.

Colin Hardy (@cybercdh) — cybercdh@gmail.com