Uma metodologia para agrupamento e extração de informações de URLs de Phishing

Abstract

Despite advances in prevention and mitigation mechanisms, phishing remains a threat. One of the reasons for this is that the agent responsible for sending these messages, the phisher, continually improves his techniques. In this work we study and characterize one of these improvements: the use by phishers of redirect chains to deceive identification mechanisms and avoid blocking the infrastructure hosting malicious content. We propose a method for grouping messages and URLs in phishing campaigns, and develop a framework for identifying the hosting infrastructure. Our results show that the hosting infrastructure of the identified campaigns is concentrated on cloud computing providers, but that some campaigns are hosted by devices on network providers, possibly on infected devices. This indicates different approaches by phishers, suggesting efforts on different fronts.