Dead Phish: An Examination of Deactivated Phishing Sites

摘要: Efforts to combat phishing and fraud online often center around filtering the messages disabling Web sites prevent users from being deceived. A couple approaches can be taken disable a site: 1) eliminate required DNS records reach site or 2) remove machine itself. While previous work has focused on take-down efforts, we focus determining how long remains after have been removed. We find that day is reported, as many 56% of remain present hosting machines even these are removed within few days, caching behavior at ISP resolvers may preserve accessibility until itself completely