Phishing Vs. Legit: Comparative Analysis of Client-Side Resources of Phishing and Target Brand Websites

Kyungchan Lim, Jaehwan Park, Doowon Kim

Keywords: phishing, client-side resources, measurement, web, security

Abstract:

Phishing attacks have persistently remained a prevalent and widespread cybersecurity threat for several years.
This leads to numerous endeavors aimed at comprehensively understanding the phishing attack ecosystem, with a specific focus on presenting new attack tactics and defense mechanisms against phishing attacks.
Unfortunately, little is known about how client-side resources (e.g., JavaScript libraries) are used in phishing websites, compared to those in their corresponding legitimate target brand websites.
This understanding can help us gain insights
into the construction and techniques of phishing websites and phishing attackers' behaviors when building phishing websites.
In this paper, we gain a deeper understanding of how client-side resources (especially, JavaScript libraries) are used in phishing websites by comparing them with the resources used in the legitimate target websites.
For our study, we collect both client-side resources from phishing websites and their corresponding legitimate target brand websites for 25 months: 7.1M phishing websites (1.1M distinct phishing domains).
Our study reveals that phishing websites tend to employ more diverse JavaScript libraries than their legitimate websites do.
However, these libraries in phishing websites are older (nearly 21.2 months) and distinct in comparison.
For example, Socket.IO is uniquely used in phishing websites to send victims' information to an external server in real time.
Furthermore, we find that a considerable portion of them still maintain a basic and simplistic structure (e.g., simply displaying a login form or image), while phishing websites have significantly evolved to bypass anti-phishing measures, such as 2FA.
Finally, through HTML structure and style similarities, we can identify specific target webpages of legitimate brands that phishing attackers reference and use to mimic for their phishing attacks.

Track: Security

Submission Guidelines Scope: Yes

Submission Guidelines Blind: Yes

Submission Guidelines Format: Yes

Submission Guidelines Limit: Yes

Submission Guidelines Authorship: Yes

Student Author: Yes

Submission Number: 1295