Authors:
Wenhao Li
1
;
2
;
Yongqing He
2
;
Zhimin Wang
2
;
Saleh Alqahtani
1
and
Priyadarsi Nanda
1
Affiliations:
1
Faculty of Engineering and IT, University of Technology Sydney, NSW 2007, Australia
;
2
Chengdu MeetSec Technology Co., Ltd., Chengdu, China
Keyword(s):
Cloaking Techniques, Evasion Techniques, Phishing Blacklists, Anti-Phishing Entities, Phishing Websites.
Abstract:
The proliferation of phishing attacks pose substantial threats to global prosperity amidst the Fourth Industrial Revolution. Given the burgeoning number of Internet users and devices, cyber criminals are harnessing phishing toolkits and Phishing-as-a-Service (PhaaS) platforms to spawn numerous fraudulent websites. In retaliation, assorted detection mechanisms, with anti-phishing blacklists acting as a primary line of defense against phishing sites, have been proposed. Yet, adversaries have contrived cloaking techniques to dodge this detection method. This study endeavors to unearth the shortcomings of prevailing blacklists and thereby bolster the efficacy of detection strategies for Anti-Phishing Entities (APEs). This paper presents an exhaustive analysis of innovative and practicable attacks on current anti-phishing blacklists, unmasking potential weaknesses in these protection mechanisms hitherto unexplored in prior research. Additionally, we divulge potential loopholes exploitable
by attackers and appraise their effectiveness against popular browser blacklists.
(More)