Evidence is gathered once, at detection, in an order chosen so the most perishable item is captured first. Everything here takes minutes; not having it costs the finding.
The order
| # | Capture | Why first or last |
|---|---|---|
| 1 | A rendered screenshot of the page, full length, with the URL bar visible | The most perishable thing there is. Content changes or disappears without warning. |
| 2 | The raw HTML response, saved to a file | Contains the form action, the asset paths and the artefacts linking it to your site. |
| 3 | The full HTTP response headers | Server, redirects, cookies. Identifies the platform and sometimes the operator. |
| 4 | The complete DNS picture — A, AAAA, MX, NS, TXT, CNAME | Changes quickly once an attacker suspects detection. |
| 5 | The TLS certificate chain, and its CT log entry | Permanent in CT, and the log entry is dated independently of you. |
| 6 | The RDAP record | The slowest to change, and it names the abuse contact you will need. |
| 7 | Your own timestamp and method notes | What you ran, when, from where. This is what makes the rest usable by somebody else. |
The whole thing in one pass
D=suspicious-lookalike.example OUT=evidence/$D/$(date -u +%Y%m%dT%H%M%SZ) mkdir -p $OUT curl -sSL -D $OUT/headers.txt -o $OUT/page.html "https://$D/" for t in A AAAA MX NS TXT CNAME SOA; do echo "== $t"; dig +noall +answer $D $t done > $OUT/dns.txt echo | openssl s_client -connect $D:443 -servername $D 2>/dev/null | openssl x509 -noout -text > $OUT/cert.txt curl -s "https://rdap.org/domain/$D" > $OUT/rdap.json curl -s "https://crt.sh/?q=$D&output=json" > $OUT/ct.json # screenshot: a headless browser, full page, URL visible
Capture what a victim sees
A phishing page frequently serves benign content to datacentre addresses. A capture taken from a cloud host may record the innocent version, which is worse than no capture — it becomes evidence in the attacker’s favour if anyone disputes the report.
Capture on detection, decide afterwards
The decision about whether to report can take a day. The evidence cannot wait for it, because the page may be gone by then. Capture everything at the moment of detection even for findings you expect to close — it costs a minute and it is the difference between a reportable finding and a recollection.