Phishing-as-a-Service (PhaaS) Platform Identification using Dark Web Data and Clustering

Phishing-as-a-Service (PhaaS) has emerged as a major enabler of cybercrime by allowing low-skilled attackers to launch sophisticated phishing campaigns using paid kits, hosting, mailing tools, and automation services. These services are extensively marketed across Dark Web forums, marketplaces, and encrypted communication channels, creating a growing underground economy that security teams cannot easily track. This research proposes a structured framework to identify PhaaS platforms using Dark Web data combined with unsupervised machine learning clustering techniques. Dark Web data is collected using Tor-based scraping from marketplaces, vendor listings, and underground forums. The unstructured text is cleaned and processed using natural language processing (NLP) methods, and meaningful features are extracted using TF-IDF and embedding-based vectorization. Clustering algorithms such as K-Means, DBSCAN, and HDBSCAN are applied to identify similar service groups, detect PhaaS vendors, and reveal hidden patterns across the ecosystem. The results show that clustering effectively groups phishing kits, sellers, pricing models, and service features, enabling automated identification of PhaaS networks. This work enhances cyber threat intelligence by providing a scalable approach to monitoring Dark Web marketplaces and detecting emerging phishing-as-a-service operations.