Fingerprint a suspected phishing/smishing kit

Turn one suspicious link into a matchable kit identity: extract the kit's structural signals (DOM skeleton, script hashes, form/exfil hosts, brand marks, URL pattern class), strip per-victim nonces and credentials BEFORE hashing, and return a stable kit_<sha256> fingerprint ID that is identical for the same kit across sightings. INPUT LIMITATION (v1): the Lambda has no JS rendering, so the url field is fetched as static HTML only. For JS-heavy kits, render the page yourself and submit the rendered HTML via the html field. Secrets, tokens, and machine identifiers are removed before hashing and are never returned or stored — two kits differing only in rotated credentials fingerprint identically. The v1b fetch pipeline also captures server-side telemetry nobody else ships in a kit API: up to 5 redirect hops, response headers (including X-Evilginx), TLS version/cipher/certificate facts for the kit host, and up to 2 bounded secondary fetches (Evilginx canary + remote favicon). OPTIONAL observed_telemetry (ja3/ja4/user_agent_shifts/app_ids/ip_anomalies/session_anomalies) records YOUR OWN proxy/EDR/IdP telemetry verbatim, marked caller_supplied — the pipeline never computes JA3/JA4 locally (those fingerprint the TLS client, not the kit server). The returned kit_family is auto-resolved: the 13 FLAME TP-0067 families Andrew approved carry family_status approved; every other name is suggested. URL -> malware-family attribution: for kind='kit' with a fetched URL, the response also carries malware_families from RelayShield's IOC corpus (empty when the corpus has no malware label for the URL) with malware_attribution='relayshield_ioc_corpus' when attributed, else null. Caller-supplied html gets no URL attribution.

Billing. $0.50 in USDC per call over x402, on Base or Solana. No API key, no signup and no subscription. Send the request with no payment header, take the 402 challenge that comes back, pay it, and repeat the request. Only successful calls are charged.