Defensive scope, and it is enforced. This runs locally with no network egress, collects nothing, and targets no real service or person. The output is detection guidance and training material — not anything deployable.
What the research is for
Credential phishing keeps working because the pages are convincing and the tells are subtle. You cannot teach people to spot something you have never looked at closely, and you cannot write good detection rules from a description.
phish-lab is a contained place to study the construction — layout conventions, urgency language, domain and certificate presentation, the small mistakes that reliably give a page away.
What comes out of it
- Recognition guides. Annotated walkthroughs of the tells, ordered by how reliable each one is.
- Detection notes. Structural patterns that survive superficial change and are therefore worth matching on.
- Training material. Side-by-side comparisons for awareness sessions.
How containment works
- Everything is served from
localhost. There is no deployment path and no hosting configuration. - Forms have no working submit target. Nothing is stored, logged, or transmitted — anywhere.
- No real brand assets, names, or domains are reproduced.
- Pages carry a visible research banner that is not removable from configuration.
Why publish it at all
The techniques are already thoroughly documented by attackers. What is comparatively scarce is clear defensive material that shows the anatomy plainly enough to be taught. Keeping the analysis private helps only the side that already has it.