It's useful to detect not only that a site is malicious, but specifically *which* phishing kit it's hosting.
Some website design choices make this very easy. We can look for values in the page which are usually unique per request, but which during the cloning process get fixed at a specific value.
This is a companion discussion topic for the original entry at https://phish.report/IOK/learn/050-unique-kit-ids