The Unbearable Lightness of Phishing Pages



Lightness of Phishing PagesResearchers at Kaspersky have found that most phishing pages are active for less than one day, with many of them going offline after just a few hours. Most of these short-lived pages were set up through hosting providers.

“Hosted phishing pages become inactive faster than the others,” the researchers write. “A quarter of the pages survived for no more than 8 hours, and only 12.3% of all pages remained active after 30 days. This has to do with the fact that the cheapest option which requires the least effort is to create a hosted phishing website. Hosting providers offer a free trial period which is usually enough for cybercriminals’ plans, and once time is up on the free trial they can simply create a new page and abandon the old one.

The longest-lasting phishing pages, meanwhile, were usually set up on compromised websites that were abandoned or left vulnerable.

“The most ‘resilient’ pages turned out to be ones created before June 2015: 45.7% of these pages remained active after 30 days,” the researchers write. “Most of these are old websites hacked by cybercriminals who put phishing content there. These pages are likely to remain active for a long time because they’ve been abandoned by their original creators or are located on servers with outdated software which leaves websites more vulnerable to attacks and their consequences.”

Most of the phishing pages contained the same content throughout their life cycles. The researchers note that many of the phishing pages that do change their content are impersonating the PUBG video game, which frequently updates its in-game products.

“Among phishing pages which have changed their content stand out those imitated prize giveaways from the game PUBG,” Kaspersky says. “This could have something to do with the fact that PUBG runs alternating temporary events (‘seasons’). Given that cybercriminals want to make their phishing pages convincing and therefore as topical as possible, they periodically change the content of pages to keep up with the new season.”

New-school security awareness training can enable your employees to avoid falling for phishing attacks.

Securelist has the story.


Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-security-test-offer

Topics: Phishing



Subscribe to Our Blog


Comprehensive Anti-Phishing Guide




Get the latest about social engineering

Subscribe to CyberheistNews