1

To clarify, my question isn't on how to protect myself from phishing. What I'm curious about is how exactly software can identify whether or not a website is designed for phishing, ignoring word identifiers/scanners to looking for spam/phishing sounding material.

1

Often times phish detection on email and web sites is detected via keywords. It's looking for text that is attempting to convince a user to input credentials, submit personal information, or even uploading documents. The anti-phish technology can also detect strong persistent language and use of hyperboles that is consistent with pressuring a user into submitting the requested information.

Examples: "enter your account information now", "your account has been disabled", "you have reached your email quota", "reply to my email immediately", etc.

Also, some very sophisticated anti-phish software can detect common typosquatter domains.

Examples of typosquatter domains could be: wellfargo[dot]com or gooogle[dot]com

  • Sorry I'm talking about the page itself, I updated it a bit. – user43731 Apr 21 '14 at 22:39
  • The equipment I've used in the past, granted was anti-phish for email, was typically looking for typosquatting and would do Whois lookups on the domain to reverse verify information. I also have never seen a perfect implementation of anti-phish technology that I felt really had a leg up on all other implementations. – PTW-105 Apr 21 '14 at 22:43
1

Most of the sites have a server certificate also called an SSL certificate which is signed by a trusted third party certificate provider (called Certificate Authority). Your browser has an inbuilt list of authorised third party certificate providers(CAs) and if the site you open provides a certificate signed by one of these CAs then the browser knows that it is a safe site.

Most phishing sites cannot obtain a valid CA certificate, because the CAs will not authorise a fake site and that is one of the easiest way to find a site which is built for phishing.

It should be noted that many companies do not get a CA certificate for their own internal websites and your browser might throw a warning when you access such sites. But if you know the site is safe you could ignore this warning.

Also I believe some browsers can check the URL as well and identify URLs which look fake. Not sure about this though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.