How browser detects Phishing Pages?

Question

I want to know how browsers detect phishing pages.And also what methodology browsers use to detect phishing pages?

Answer 1

I'm not aware of any plugins specifically that do this, but in the case of the Google search engine, or something like Norton DNS or google DNS it's all done on reputation.

For example if you report a page as a phishing page, then a hundred other people also report it, when that search result comes up in google it will say that the page is potentially unsafe. If you're using a service such as Norton DNS then it will direct you away from that page.

I would imagine any browser plugin or functionality would do something along the same lines, checking each URL against a reputational database before advising whether it is a safe link or not.

Answer 2

Detecting Phishing and Malware sites by browsers like Chrome and IE is based on lookups made into databases. These databases are held by the browser owners and DNS servers.

If you consider the example of Google safe browsing that works with every browser :

http://www.google.com/transparencyreport/safebrowsing/?hl=en

This service scans the web and builds up a reputation system that enables them to categorize a website as suspicious.

The reputation system considers several aspects, for eg:

When was the domain registered. Does the domain name resemble a brand or popular service. If yes, what is the authenticity where it has been hosted. Is it reported suspicious by other vendors .

These are a rough calculations that an automated URL categorizer can make and base don it decide the reputation of the website.