To clarify, my question isn't on how to protect myself from phishing. What I'm curious about is how exactly software can identify whether or not a website is designed for phishing, ignoring word identifiers/scanners to looking for spam/phishing sounding material.
2 Answers
Often times phish detection on email and web sites is detected via keywords. It's looking for text that is attempting to convince a user to input credentials, submit personal information, or even uploading documents. The anti-phish technology can also detect strong persistent language and use of hyperboles that is consistent with pressuring a user into submitting the requested information.
Examples: "enter your account information now", "your account has been disabled", "you have reached your email quota", "reply to my email immediately", etc.
Also, some very sophisticated anti-phish software can detect common typosquatter domains.
Examples of typosquatter domains could be: wellfargo[dot]com or gooogle[dot]com
-
-
The equipment I've used in the past, granted was anti-phish for email, was typically looking for typosquatting and would do Whois lookups on the domain to reverse verify information. I also have never seen a perfect implementation of anti-phish technology that I felt really had a leg up on all other implementations.– PTW-105Apr 21, 2014 at 22:43
Most of the sites have a server certificate also called an SSL certificate which is signed by a trusted third party certificate provider (called Certificate Authority). Your browser has an inbuilt list of authorised third party certificate providers(CAs) and if the site you open provides a certificate signed by one of these CAs then the browser knows that it is a safe site.
Most phishing sites cannot obtain a valid CA certificate, because the CAs will not authorise a fake site and that is one of the easiest way to find a site which is built for phishing.
It should be noted that many companies do not get a CA certificate for their own internal websites and your browser might throw a warning when you access such sites. But if you know the site is safe you could ignore this warning.
Also I believe some browsers can check the URL as well and identify URLs which look fake. Not sure about this though.
