# PhishParrot: LLM-Driven Adaptive Crawling to Unveil Cloaked Phishing Sites

arXiv: https://arxiv.org/abs/2508.02035 · HTML: https://mlsanity.com/paper/2508.02035/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 4 Aug 2025.

## Built on by (most cited first, 3 of 3)

- [A Whole New World: Creating a Parallel-Poisoned Web Only AI-Agents Can See](https://mlsanity.com/paper/2509.00124/) (2025)
- [Small Language Models for Phishing Website Detection: Cost, Performance, and Privacy Trade-Offs](https://mlsanity.com/paper/2511.15434/) (2025)
- [PhishLumos: An Adaptive Multi-Agent System for Proactive Phishing Campaign Mitigation](https://mlsanity.com/paper/2509.21772/) (2025)

## Abstract (arXiv)

Phishing attacks continue to evolve, with cloaking techniques posing a significant challenge to detection efforts. Cloaking allows attackers to display phishing sites only to specific users while presenting legitimate pages to security crawlers, rendering traditional detection systems ineffective. This research proposes PhishParrot, a novel crawling environment optimization system designed to counter cloaking techniques. PhishParrot leverages the contextual analysis capabilities of Large Language Models (LLMs) to identify potential patterns in crawling information, enabling the construction of optimal user profiles capable of bypassing cloaking mechanisms. The system accumulates information on phishing sites collected from diverse environments. It then adapts browser settings and network configurations to match the attacker's target user conditions based on information extracted from similar cases. A 21-day evaluation showed that PhishParrot improved detection accuracy by up to 33.8% over standard analysis systems, yielding 91 distinct crawling environments for diverse conditions targeted by attackers. The findings confirm that the combination of similar-case extraction and LLM-based context analysis is an effective approach for detecting cloaked phishing attacks.