Bluekit PhaaS: Oversized JS Bundle (>1MB) Fetched via HTTP

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

Detects HTTP responses containing JavaScript files with a Content-Length exceeding 1MB. This behavior is associated with the Bluekit PhaaS (Phishing-as-a-Service) platform, which uses large, obfuscated JavaScript bundles for browser fingerprinting and to evade static security signatures.