Proactive Detection of Phishing Kit Traffic

Cui, Qian; Jourdan, Guy-Vincent; Bochmann, Gregor von; Onut, Iosif-Viorel

doi:10.1007/978-3-030-78375-4_11

Cited by 5 publications

(3 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Phishing Detection: phishing detection is a very active research field e.g., [4,11,29,43]. Most previous research focus on textual features such as URLs [27,39,50], or HTML content [28,43,48].…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

LogoMotive: Detecting Logos on Websites to Identify Online Scams - A TLD Case Study

Hout

Wabeke

Moura

et al. 2022

Passive and Active Measurement

View full text Add to dashboard Cite

Logos give a website a familiar feel and promote trust. Scammers take advantage of that by using well-known organizations' logos on malicious websites. Unsuspecting Internet users see these logos and think they are looking at a government website or legitimate webshop, when it is a phishing site, a counterfeit webshop, or a site set up to spread misinformation. We present the largest logo detection study on websites to date. We analyze 6.2M domain names from the Netherlands' countrycode top-level domain .nl, in two case studies to detect logo misuse for two organizations: the Dutch national government and Thuiswinkel Waarborg, an organization that issues certified webshop trust marks. We show how we can detect phishing, spear phishing, dormant phishing attacks, and brand misuse. To that end, we developed LogoMotive, an application that crawls domain names, generates screenshots, and detects logos using supervised machine learning. LogoMotive is operational in the .nl registry, and it is generalizable to detect any other logo in any DNS zone to help identify abuse.

show abstract

Section: Related Workmentioning

confidence: 99%

“…Recently, phishing kit detection has risen in popularity [4,11,42]. Phishing kits are purchasable, easily deployable phishing site templates.…”

Section: Related Workmentioning

confidence: 99%

LogoMotive: Detecting Logos on Websites to Identify Online Scams - A TLD Case Study

Hout

Wabeke

Moura

et al. 2022

Passive and Active Measurement

View full text Add to dashboard Cite

show abstract

“…Recently, researchers have found that phishing attacks have changed, and cyber criminals are using phishing tool kits to deploy attacks in a faster, easier and more massive way against defined targets [18]- [20]. Phishing kits contain ready-to-deploy phishing websites, scripts to automatically save stolen data, and other functionalities to help them deceive people effortlessly.…”

Section: Introductionmentioning

confidence: 99%

PhiKitA: Phishing Kit Attacks Dataset for Phishing Websites Identification

Castano¹,

Fidalgo²,

Aláiz-Rodríguez³

et al. 2023

IEEE Access

View full text Add to dashboard Cite

Recent studies have shown that phishers are using phishing kits to deploy phishing attacks faster, easier and more massive. Detecting phishing kits in deployed websites might help to detect phishing campaigns earlier. To the best of our knowledge, there are no datasets providing a set of phishing kits that are used in websites that were attacked by phishing. In this work, we propose PhiKitA, a novel dataset that contains phishing kits and also phishing websites generated using these kits. We have applied MD5 hashes, fingerprints, and graph representation DOM algorithms to obtain baseline results in PhiKitA in three experiments: familiarity analysis of phishing kit samples, phishing website detection and identifying the source of a phishing website. In the familiarity analysis, we find evidence of different types of phishing kits and a small phishing campaign. In the binary classification problem for phishing detection, the graph representation algorithm achieved an accuracy of 92.50%, showing that the phishing kit data contain useful information to classify phishing. Finally, the MD5 hash representation obtained a 39.54% F1 score, which means that this algorithm does not extract enough information to distinguish phishing websites and their phishing kit sources properly.

show abstract