Server-side polymorphism is a technique where the web server generates different content for each request, so the same phishing URL can return a new page every time. The goal is to make a landing page harder to fingerprint with file hashes, fixed HTML markers, or simple script signatures. Instead of serving one static copy, the attacker changes elements such as text, structure, identifiers, or embedded code on demand.
This matters because many defenses still rely on recognizing a known-bad sample. When the page mutates server-side, a scanner may see one version while the next visitor gets another, reducing the value of one-time analysis and static blocklists. In real attacks, this is often used to keep credential-harvesting pages active while frustrating detection. Defenders respond by re-fetching suspicious URLs, comparing multiple responses, rendering pages in a browser, and inspecting form destinations and behavior rather than appearance alone. Phishing-resistant MFA further limits the damage if credentials are captured.