Phishing site investigation from the targeted region

Reported URL and full redirect chain

Every hop with status code and timestamp. Shorteners and gates in the chain are often reportable infrastructure in their own right.

Final landing page: HTML, DOM and screenshot

What the targeted visitor saw. The core of the takedown evidence.

HAR file with SHA-256 hash

A complete, verifiable record of the session. Hash it at capture time and log the hash with the case.

Exit country, city and network type

Shows which audience the content was served to, and explains why a host checking from elsewhere may see a decoy.

Impersonated brand and kit fingerprints

Page titles, asset paths and form targets. Lets you cluster reports that come from the same kit or operator.

Hosting, registrar and certificate details

Where to send the takedown, and links to other domains on the same infrastructure.

Control fetch result

What the same URL served to a non-target context. The difference is evidence of deliberate cloaking.

Liveness checks after the report

Up or down over time, so you know when to escalate and when to close.

1. 01

   Triage the report and pick the audience

   From the lure itself (language, brand, sender, SMS or email), decide which country and device the campaign targets. That decides the exit: residential in the target country, or a carrier exit for a phone lure.

2. 02

   Fetch once, from an isolated browser, on one sticky exit

   Run a disposable browser in a container or VM, hold one sticky session for the whole redirect chain, and record a HAR, screenshot and DOM. Do not type into forms.

   Evidence capture on a sticky residential exit22 linescopy

   import hashlibimport pathlibfrom datetime import datetime, timezonefrom playwright.sync_api import sync_playwrightSERVER, PASSWORD = "http://proxy.arcproxies.io:8000", "PASSWORD"def capture(case_id: str, url: str, country: str, out: pathlib.Path):    user = f"USERNAME_pool-arcfast_country-{country}_session-{case_id}_sesstime-10"    har = out / f"{case_id}.har"    with sync_playwright() as p:        browser = p.chromium.launch(proxy={"server": SERVER, "username": user, "password": PASSWORD})        ctx = browser.new_context(record_har_path=str(har))        page = ctx.new_page()        page.goto(url, wait_until="load")  # observe only: never fill or submit forms        page.screenshot(path=str(out / f"{case_id}.png"), full_page=True)        (out / f"{case_id}.html").write_text(page.content())        ctx.close()  # flushes the HAR        browser.close()    digest = hashlib.sha256(har.read_bytes()).hexdigest()    return {"case": case_id, "captured_at": datetime.now(timezone.utc).isoformat(),            "exit_country": country, "har_sha256": digest}

3. 03

   Run a control fetch

   Fetch the same URL from a non-target context, such as another country, and record what it serves. A decoy there and a lure in the target region documents the cloaking for the host.

4. 04

   Report with the evidence attached

   Send the takedown to the host and registrar, and submit the URL to the blocklists your organisation uses. Include the exit location so the recipient knows where to look from.

5. 05

   Re-check until it is gone

   Check liveness every few hours from the target region with a light request, and escalate if the site is still up after the host's stated response time.

Prices are list prices in EUR, excl. VAT. Volume discounts apply automatically at checkout — full ladder on the pricing page.