Does domain highlighting help people identify phishing sites?

Abstract

Phishers are fraudsters that mimic legitimate websites to steal user's credential information and exploit that information for identity theft and other criminal activities. Various anti-phishing techniques attempt to mitigate such attacks. Domain highlighting is one such approach recently incorporated by several popular web browsers. The idea is simple: the domain name of an address is highlighted in the address bar, so that users can inspect it to determine a web site's legitimacy. Our research asks a basic question: how well does domain highlighting work? To answer this, we showed 22 participants 16 web pages typical of those targeted for phishing attacks, where participants had to determine the page's legitimacy. In the first round, they judged the page's legitimacy by whatever means they chose. In the second round, they were directed specifically to look at the address bar. We found that participants fell into 3 types in terms of how they determined the legitimacy of a web page; while domain highlighting was somewhat effective for one user type, it was much less effective for others. We conclude that domain highlighting, while providing some benefit, cannot be relied upon as the sole method to prevent phishing attacks.

Learn to Spot Phishing URLs with the Android NoPhish App

“…Different tricks should be explained in different levels of NoPhish. There are several approaches to categorize URL spoofing tricks [4,6,15]. We propose to use a different categorization; one that is based on the difficulty to detect the corresponding spoofing trick.…”

“…Therefore, the tools' checks need to be complemented by humans checking the URLs. Yet, many people lack the required knowledge to properly check URLs [5,6] and assess the trustworthiness of a given website. Some people are even not aware of faked messages and websites at all and, thus, are not aware that they should check URLs before providing sensitive information [7,5].…”

Eyes of a Human, Eyes of a Program: Leveraging Different Views of the Web for Analysis and Detection

“…Traditional browser solutions to help users be aware of the phish, such as domain highlighting and phishing warnings, have shown to be not very effective [23,29]. To better inform users, researchers have proposed in-browser protection systems.…”

Sophisticated Phishers Make More Spelling Mistakes: Using URL Similarity against Phishing

“…Domain highlighting in the browser's location bar is used by browser vendors to counteract such attacks but users are still being tricked by them [18].…”