Design and Implementation of an System for Automatic Phishing Platform Saturation

Abstract

This thesis presents the design, implementation, and evaluation of an automated system for active defense against phishing attacks using platform saturation. Unlike traditional detection-centric approaches, the proposed system actively degrades the value of data collected by attackers by automatically submitting realistic, synthetically generated information into phishing forms. The system integrates large language models (LLaMA 3.1, GPT-5-mini) for phishing page detection, language identification, registration page recognition, and semantic field classification. A hybrid field recognition layer combines rule-based heuristics with LLM inference. A Playwright-based automation module with an LLM-driven multi-step orchestrator performs autonomous form filling, submission, and email verification via disposable temporary email addresses. The system was evaluated on a public phishing dataset and on purpose-built test registration website. The phishing detection module achieved an F1 score of 0.750 (GPT-5-mini), registration page recognition reached 0.986 F1, while field detection achieved 0.582 accuracy, identifying remaining robustness challenges. The automation module successfully completed full registration cycles including email verification in controlled laboratory conditions. The results demonstrate that LLM-based saturation is technically feasible and offers a complementary active defense strategy worthy of further research.