urlscan.io Blog

The urlscan Threat Research Team identified a phishing site impersonating Prove, an identity verification provider, which stood out due to the notable nature of the company being targeted. A single distinctive JavaScript global variable present on the page provided an effective starting point for clustering, ultimately revealing a shared phishing framework used against a range of smaller and lesser-known financial sector brands.

This brief documents the initial discovery, the pivots used to expand the cluster, and the resulting victimology, which shows a clear preference for targeting financial services companies that receive comparatively little public attention.

During routine review of recent suspicious scans on our platform, the urlscan Threat Research Team was able to identify a phishing site impersonating Prove.

The page contained a unique JavaScript global variable, __panelFrontsDevtoolsTrapStarted__, which was designed to trigger developer tools detection functionality within the phishing kit. However, due to implementation errors in the site’s code, the code fails to run in most scenarios.

Using framework identifiers or distinct code structures presents a far more resilient strategy for hunting phishing clusters compared to relying on ephemeral indicators like IPs, hosting providers, or file hashes. Infrastructure-level indicators are trivially rotated; threat actors routinely swap hosting, cycle proxy IPs, and alter file contents. In contrast, framework identifiers capture the structural DNA of a kit. Because these unique variables are coded, sometimes deep within a kit, and often provide core logic of the phishing framework, they persist across different campaigns and servers, helping to cut through infrastructural noise and map out an entire adversary’s cluster with a single, highly targeted search query. This dynamic highlights why intelligence teams rarely publish granular kit-hunting logic, as keeping these indicators low-profile prolongs their operational lifespan. When a file hash is the only overlapping indicator, pairing it with a second query parameter helps prevent overmatching, while continuous monitoring ensures you catch new deployments if that hash shifts.

The phishing kit bundles a socket.io JavaScript library implementation. Searching for the hash of this file returns a broad set of results, though not all of these are related or relevant, as the underlying library is not unique to this kit.

Combining the file hash with a distinctive filename observed across the cluster produces a clean and more reliable set of results.

The resulting cluster shows a consistent pattern: rather than impersonating large, widely recognized financial institutions, the operators behind this kit have overwhelmingly targeted smaller and less prominent brands. Alongside Prove, observed targets include the US Bank Singlepoint login page, AMINA E-Banking, and Currency Cloud, as well as smaller financial platforms such as Pleo, Slim CD, PayMongo, and Aspire.

This emphasis on lesser-known financial brands is notable in itself. Smaller organizations may receive less scrutiny from security researchers and are less likely to have dedicated brand-monitoring or anti-phishing programs in place, potentially making them more attractive targets despite their comparatively lower profile.

Infrastructure

Most hostnames observed in this cluster are fronted by Cloudflare, which limits visibility into the underlying hosting infrastructure. However, several of the hostnames share the same pair of Cloudflare nameservers, providing a further link between otherwise separate sites.

Given the limited visibility into backend infrastructure, it cannot be determined with confidence whether a single threat actor operates all of the sites identified in this cluster. However, the consistent codebase and bundled files strongly indicate that these sites were built using the same phishing framework, suggesting either a single actor deploying it against multiple targets or a shared kit being distributed to, and reused by, several operators.

Conclusion

This cluster illustrates that phishing kit operators do not always target the largest or most recognizable financial brands. In this case, the tooling has been repeatedly deployed against smaller identity verification and financial services providers, a pattern that may reduce the likelihood of rapid detection and takedown. The urlscan Threat Research Team will continue to monitor this framework for further deployments and additional targeted brands.

More on urlscan Pro

If you want to learn about the urlscan Pro platform and how it might be valuable for your organization feel free to reach out to us! We offer free trials with no strings attached. We would be happy to give you a passionate demo of what our platform can do for you. Reach out to us at sales@urlscan.io.