Phish-Net: Investigating phish clusters using drop email addresses

Abstract

The most common approach to collect users' secret credentials from phishing websites is to email the credentials to criminals' email addresses which we call drop email addresses. We propose a clustering algorithm, which is based on the assumption that if there is a common drop email address found in the phishing kits from two different phishing websites, then these two websites are directly related. Based on obfuscated and plain-text drop email addresses, we produce two types of clusters: one is called phishing kit creator cluster and another is kit user cluster. Clustering related phishing websites using our proposed approach will allow phishing investigators to focus their investigative efforts on important phishing attacks rather than random attacks. For example, in January 2013, 1475 phishing websites are hosted by only 317 groups of phishers (who we will call kit users). Our scheme will thus help investigators to narrow investigation to pervasive phishing criminals. By analyzing the clusters generated using our clustering approach, we can determine the strongest and most pervasive phishers, and phishing kit creators, relationships between phishing kit creators and phishing kit users, and the most dominant phisher of one group. These findings have real-life implication in phishing investigation paradigm.

Data Breaches, Phishing, or Malware?

“…The number of phishing websites that rely on kits (as opposed to custom deployments) is unknown, but previous work by Zawoad et al found 10% of phishing sites active in 2013 left trace evidence of phishing kits [39]. This is a lower bound due to a limited coverage in the detection technique for phishing kits and because miscreants may delete traces of the kit after deployment.…”

“…The type of information stolen depends on the kits, but prior studies have shown that they harvest a victim's username, password, and geolocation information among other sensitive data [8,19,30,39]. Han et al estimated the success rate of kits by monitoring the activity of real visitors to infected honeypots, of which 9% submitted some data to the phishing page [19].…”

Using Clustering Algorithms to Automatically Identify Phishing Campaigns

“…Work on phishing profiling was aimed to understand and observe attacker activities to better predict phishing emails [30], while some studies [35], [36] use it as a first step to improve the accuracy of a phishing/benign classifier. Seifollahi et al [37] focused more on the authorship analysis and identifying the cybercriminal groups, while Zawoad et al clustered emails in order to identify phishing attacks generated by off-the-shelf phishing kits [38]. Approaches have also looked at using semi-supervised phishing profiling to predict new spear phishing campaigns [39].…”

High-Performance Classification of Phishing URLs Using a Multi-modal Approach with MapReduce

“…[17] and [18] use a structural analysis technique comparing local domain files to create clusters of related phish. Zawoad et al cluster phishing websites using email addresses receiving the phished credentials [19]. These email addresses are found in the phishing kits used to create the phishing websites.…”