Study: Most phishing pages are abandoned or disappear in a matter of days

2 years ago 311

Research from Kaspersky finds that a 4th of phishing sites are gone wrong 13 hours — however successful the satellite tin we drawback and halt cyber criminals that determination truthful quickly?

Email / envelope with achromatic papers and skull icon. Virus, malware, email fraud, email spam, phishing scam, hacker onslaught concept. Vector illustration

Research from cybersecurity steadfast Kaspersky has recovered that astir phishing websites vanish oregon spell inactive wrong days, giving america yet different crushed to fearfulness phishing: It's fly-by-night, hard to way and happens successful a flash.

Kaspersky's in-depth investigation of phishing websites recovered that astir 3 quarters of each phishing pages halt showing signs of enactment wrong 30 days. A 4th of those are dormant wrong 13 hours, and fractional past nary much than 94 hours, oregon conscionable nether 4 days.

The fearfulness and paranoia that phishing tin evoke whitethorn lone beryllium made worse by this news, but person faith: Kaspersky said that it believes its information "could beryllium utilized to amended mechanisms for re-scanning pages which person ended up successful anti-phishing databases, to find the effect clip to caller cases of phishing, and for different purposes," each of which could marque katching, tracking and sidesplitting phishing pages and their operators easier.

SEE: Google Chrome: Security and UI tips you request to know (TechRepublic Premium)

Kaspersky pulled a full of 5,310 links identified arsenic atrocious by its anti-phishing engine, and tracked those pages implicit the people of 30 days. "Over a thirty-day play from the infinitesimal a "phishing" verdict was assigned to a page, the investigation programme checked each nexus each 2 hours and saved the effect codification issued by the server arsenic good arsenic the substance of the retrieved HTML page," Kaspersky said.

Based connected the accusation it gathered implicit that 30-day period, Kaspersky decided to absorption connected the rubric of the page, its size and its MD5 hash (which changes erstwhile immoderate edit is made to a website). Those criteria allowed Kaspersky to physique an investigation method that classified pages arsenic having antithetic content, a alteration successful phishing people oregon nary change.

What Kaspersky learned astir phishing websites

A batch of accusation tin beryllium gleaned from those fewer publically disposable statistic astir a page, and Kaspersky has done conscionable that with the phishing information it investigated.

Life rhythm statistic whitethorn beryllium the astir surprising; arsenic mentioned above, phishing pages thin to vanish quickly. "The classification of links according to the fig of hours they survived shows the bulk of phishing pages were lone progressive for little than 24 hours. In the bulk of cases, the leafage was already inactive wrong the archetypal fewer hours of its life," Kaspersky said successful its report.

In summation to learning that phishing pages are abbreviated lived, the survey besides recovered that phishing pages astir ever stay unchanged passim their progressive period. Some changes bash occur, arsenic with a run targeting players of the PC crippled PlayerUnknown's BattleGrounds that was regularly edited to support up with in-game events.

Not once, however, did a phishing website alteration its people successful the people of Kaspersky's study, which it attributed to the information that galore phishing websites trust connected spoofed domain names made to intimately mimic morganatic websites. "This benignant of phishing is hard to reorientate to transcript a antithetic organization, and it's easier for the cybercriminals to make a caller phishing leafage than tweak an existing one," Kaspersky said.

Pages besides occasionally alteration thing connected the backmost end, which causes their MD5 hashes to alteration and phishing filters to not admit the leafage if it uses hashes to place content.

Kasperksy breaks its information down adjacent further, grouping pages by 4 ceremonial criteria: Date of domain creation, apical level domain (like .com oregon .org), determination of the phishing leafage connected the website's directory (root oregon determination else), and domain level wherever the leafage is located.

SEE: Password breach: Why popular civilization and passwords don't premix (free PDF) (TechRepublic)

There's a batch of further information to interruption down, and for each the details beryllium definite to work Kaspersky's afloat report. Suffice it to say, the astir pertinent accusation for information professionals looking to place phishing pages and basal them retired tin beryllium recovered successful the statistic and easy rephrased arsenic recommendations:

Dynamic DNS website DuckDNS is simply a communal mode cybercriminals fake domain names: It's a escaped DNS work that anyone tin make a subdomain and registry a tract on. If your concern has nary transportation to DuckDNS oregon its services, it whitethorn beryllium a bully thought to artifact it internally.
Phishing pages located connected website subdirectories are acold much resilient than those astatine the top-level of a domain. If you're disquieted astir the integrity of your website, beryllium definite to scan everything to cheque for suspicious codification hiding retired successful a deep, rarely-frequented portion of your site.
Phishing pages seldom change. If you cognize that your radical oregon enactment person go a target, beryllium definite to place phishing pages and get them blocked arsenic accelerated arsenic possible.

Unfortunately, without being capable to enactment Kaspersky's phishing tract recognition methodology into signifier astatine a ample scale, it lone serves to punctual america erstwhile again that phishing is real, it's serious, and it's incredibly tricky to pin down. Be definite you're implementing best anti-phishing practices and different phishing awareness measures.

Cybersecurity Insider Newsletter

Strengthen your organization's IT information defenses by keeping abreast of the latest cybersecurity news, solutions, and champion practices. Delivered Tuesdays and Thursdays