# PhishParrot: LLM-Driven Adaptive Crawling to Unveil Cloaked Phishing Sites

**Authors:** Hiroki Nakano, Takashi Koide, Daiki Chiba  
**arXiv:** [2508.02035](https://arxiv.org/abs/2508.02035)  
**Date:** 2025-08-04  
**Summary page:** https://www.summarizepaper.com/en/paper/2508.02035v1/

## Key points

- Phishing attacks are evolving with cloaking techniques that challenge detection efforts
- PhishParrot is a novel crawling environment optimization system utilizing Large Language Models (LLMs)
- PhishParrot collects information on phishing sites, adapts browser settings, and network configurations to bypass cloaking mechanisms
- In a 21-day evaluation, PhishParrot showed up to 33.8% improvement in detection accuracy compared to standard systems
- PhishParrot successfully identified 91 distinct crawling environments targeted by attackers
- Limitations include potential execution overhead from selection process and the need for successful and failed examples for reference
- The system automatically accumulates cases of trending phishing attacks and cloaking patterns once initial examples are prepared

## Summary

, , , , 

Phishing attacks are constantly evolving, with cloaking techniques presenting a significant challenge to detection efforts. These methods allow attackers to display phishing sites only to specific users while showing legitimate pages to security crawlers, making traditional detection systems ineffective. To combat this threat, a novel crawling environment optimization system called PhishParrot has been developed. This system utilizes Large Language Models (LLMs) for contextual analysis and identifies potential patterns in crawling information, allowing for the creation of optimal user profiles that can bypass cloaking mechanisms. PhishParrot works by collecting information on phishing sites from various environments and adapting browser settings and network configurations based on similar cases of targeted users. In a 21-day evaluation, PhishParrot showed a significant improvement in detection accuracy, with an increase of up to 33.8% compared to standard analysis systems. It successfully identified 91 distinct crawling environments representing different conditions targeted by attackers. While effective, PhishParrot does have some limitations. The selection process for crawling environments may introduce additional execution overhead, but this is offset by the improved phishing site detection rate. Additionally, the system requires a certain number of successful and failed examples for reference from similar attacks. However, once several hundred initial examples are prepared, PhishParrot automatically accumulates cases of trending phishing attacks and cloaking patterns. In conclusion,<Organization>s innovative approach to combating cloaked phishing attacks combines similar-case extraction and LLM-based context analysis. This research has been accepted for publication at IEEE Globecom 2025 and provides valuable insights into enhancing defenses against evolving threats in the realm of cybersecurity.