Detecting Phishing Websites Through Domain and Content Analysis

Abstract

Many security incidents within the digital space focus on deceiving human users through the use of phishing websites that are built to capture and steal credentials. Phishing websites are designed to look similar to legitimate websites. In this paper the authors focus on developing a new solution for detecting specific phishing websites based on domain and content analysis. A phishing website is detected when it’s domain is similar to a legitimate service or includes the legitimate service name as a subdomain. Content analysis is performed to detect if the suspicious website contains elements of an authentication form used to steal credentials.