Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts. Method and limits
The 21 October advertisement offered seven days of a phishing dashboard for $250 and a free 24-hour trial. Templates came with the subscription. Messaging carried a separate charge. The seller also said it would run the browsers on its own servers.
That last promise changes the reading of the offer. The buyer was being offered relief from part of the technical work, alongside access to software. The price described an ongoing service relationship. It did not cover every task or every charge.
We compared selected phishing-related advertisements in Brandefense’s saved Blackhole collection. Their terms reveal a useful distinction: some offer a software package the buyer must run; others offer to keep parts of that work with the provider. Support, renewals and separate delivery charges show where that division sits.
These are advertised arrangements, not services we purchased or tested. Dollar signs in the examples below do not identify a dollar denomination. The 21 October catalogue entry, FR-O007, preserves the asking periods and the stated limits.
A Software Purchase Can Still Leave A Support Bill
A 16 May advertisement separates editable source code from an executable restricted to one device. It also offers setup help. Both options include two months of support, followed by an advertised $100 monthly support charge.
The difference is partly about what the buyer receives. Source code is described as editable; the executable is sold as ready to run. The separate support term adds another distinction: buying the package does not end every possible relationship with the seller. Help after the included period has its own price.
This is why a one-time software price cannot tell us how much technical work has been transferred. The same advertisement lists requirements for running the package. Its offer of setup and later support addresses work that remains around the delivered files. See the source, executable and support terms in FR-O004.
A separate 7 April ad makes the purchase-versus-access distinction within one adjacent tool suite. It lists $400 for monthly access and $800 for source code. That is evidence of two purchase options for the same advertised suite, not proof that buying source confers unrestricted ownership or removes later costs.
The suite supports mailing and account-recovery checking; we do not treat it as a complete phishing kit. Its value in this comparison is narrower. FR-O003 shows that the access model can change while the named software stays the same.
The Hosted Offer Moves Work Back To The Provider
The 29 June advertisement takes a different position. It bundles dashboard access, a personal licence key and support. It explicitly says the customer needs neither a server nor a domain. No price is stated.
That short description makes the provider’s proposed role unusually clear. The offer is not merely to supply files and answer questions. It claims to remove infrastructure that the customer would otherwise need to provide. The absence of a price does not make this difference less informative.
The October dashboard offer describes a related division of work. It says browsers run on the seller’s servers and that customers do not need to manage those servers. Its seven-, fourteen- and thirty-day access periods put that promise inside a renewable relationship.
Our reading is about dependence, not proven ease of use. Under the advertised arrangement, the customer relies on continued access to the provider’s environment. A source-code package and a hosted subscription therefore describe different roles for the seller, even when both use the word “kit.”
The relevant evidence is in the June hosted bundle, FR-O011, and the October dashboard entry. We did not test either provider’s infrastructure or its claims about technical skill.
Included Templates Do Not Make Everything Included
The October advertisement says one subscription opens its whole advertised template library. That is a claim about access to the library. The same post bills messaging by segment, without giving a segment price.
Those two terms separate the software environment from a usage charge. They explain why the advertised $250 for seven days cannot stand for the full cost of using every offered feature. The missing messaging rate also prevents a reliable total from being calculated.
A 10 June panel advertisement adds another form of continuing purchase. It promises thirty days of access and support, then mentions renewal and credit top-ups. It supplies no prices for those credits. Its menu describes replenishment after initial access, rather than a single finished delivery.
In both examples, the continuing relationship is visible in the terms themselves. A subscription creates an access period; a credit top-up creates another possible purchase; support creates a continuing service promise. These are distinct parts of the advertised arrangement, even when presented together.
FR-O010 records the thirty-day panel offer. It helps explain the commercial structure without requiring us to accept the advertisement’s success claims.
Some Sellers Offer To Do Individual Jobs
A 25 February menu lists custom phishing-kit development alongside rented infrastructure and outsourced emailing. It does not provide quantities, rates or durations. Its contribution to this comparison is the separation of jobs: developing a tool, supplying infrastructure and sending messages are offered as different services.
That menu prevents an overly simple split between “buy software” and “rent software.” An advertisement can offer to take over a particular task without claiming to supply the entire operation. FR-O013 records those service categories; it does not establish that customers combined them.
Together, these examples show sellers advertising several places to draw the boundary of responsibility. A buyer can be offered files, ongoing access, later technical help or a separate supporting service. The distinctive finding is that this boundary is visible in the terms, even when a headline price is missing.
Similar Tools Need Not Mean The Same Operator
The provider role matters to threat intelligence. Another selected promotion explicitly advertises separate customer accounts and service management. FR-O012 presents a provider serving multiple customers as part of the product design.
This gives investigators a concrete alternative to consider when incidents share a product name or page design: separate users of a common advertised service. It does not establish that any incidents in our collection shared infrastructure, a provider or an operator. That relationship needs its own evidence.
The distinction changes what should be preserved in an investigation. A tool match describes a technical or product relationship. Evidence that the same person controls two operations describes a different relationship. Combining them too early can turn a supplier’s reusable product into a false actor identity.
The comparison of 831 recruitment posts tests a related problem in advertising: different complete texts can still carry the same narrow offer. Product similarity and text novelty each answer less than they first appear to.
What These Terms Let Us Conclude
The selected ads sell more than a named tool. They describe who is supposed to keep the environment running, when access ends, and which help or usage may cost extra. That is the work allocation hidden by a simple list of kit prices.
For an investigation, record the advertised provider role alongside the software name. Then keep that role separate from the identity of anyone using the software. This follows directly from the source-versus-hosted comparison and the explicit customer-management claim; it does not depend on accepting any advertised bypass capability.
We read the relevant full saved posts and compared their terms within the Fraud edition’s selected evidence catalogue. The wider collection covers 1 January to 27 October 2026. The examples were selected for analysis, not to estimate the share of each business model.
Our phishing-methods investigation separately examines the access these services advertise.
The account-participation investigation examines another kind of work in the same archive: offers seeking a person’s involvement with an account. Across these different cases, the useful question is what the advertiser wants someone else to do.
