New anti-phishing system finds scam networks by mapping domains, IPs, and certificates
Phishing sites do not always look dangerous when security tools arrive. Sometimes they show an error page. Sometimes they redirect to a real company website. Sometimes they simply refuse to respond. That cat-and-mouse problem has helped online scams stay one step ahead of many defenses. Now a team at Tokyo Metropolitan University says it has built a system that uses that evasive behavior itself as a clue, then works outward to uncover the broader phishing campaign behind it. The system, called PhishLumos, does not start by asking whether one suspicious web link is good or bad. Instead, it treats hidden or misleading content as a signal to inspect the website’s surrounding infrastructure, including domains, IP addresses, certificates, and related network connections. The goal is to map out the campaign, not just judge one link in isolation. In tests on 103 real phishing campaigns, the system identified malicious activity an average of 8 days before expert verification. In a separate six-month real-world study, rules generated from 600 difficult starting links led to the discovery of 192,407 …







