Millions of Phishing Websites Are Created Every Month: Uncover Their Masks

No one wants to be the silly fish that hooks up on random bait. The fishing analogy works just fine when we want to tell users what it feels like when they get tricked by phishing websites, email messages, and pop-ups. After all, the word "phishing" didn't come out of nowhere: the comparison is there, and it is appropriate.

As you can probably tell, in this blog entry, we will tell you more about phishing and phishing websites. We hope that the information in this post will help you recognize such web pages in the future, and you will be able to protect yourself from personal data theft.

What Is Phishing?

Before we go down to the main topic of our entry, we would like to give you a general idea about what phishing is. To put it simply, phishing is a malicious activity that allows scammers to steal sensitive information. This sensitive information may include usernames, passwords, credit card details, and so on. Phishing attacks might be carried out through email messages, instant messages, and other social engineering techniques that reach users through various Internet channels.

For example, a spam email message is often a part of a phishing scam. For example, users can receive an email that looks like a legitimate notification from a specific bank. The message usually contains an outgoing link, and users are urged to click that link in order to confirm their identity. However, by "confirming" their identity they would only give away that information to cybercriminals.

So we can see that a phishing attack basically consists of two parts: the message and the source page. We have already covered what users should do to avoid the first constituent of this chain. Therefore, today we would like to focus on phishing websites instead.

Phishing Websites

It would be great if we could provide you with the list of phishing websites, and you could pin it somewhere in order to avoid them. Unfortunately, security experts suggest that such pages have a really short lifespan. Reportedly, they are replaced every few hours to avoid detection. The short life-span means that there are millions of such websites out there. A report by WebRoot claims that around 1.4 million phishing websites are created on average every single month.

Since these websites are short-lived, they are able to avoid block lists that are one of the traditional anti-phishing strategies. A static list becomes outdated in a matter of seconds, and users can no longer rely on it when they need to verify whether a certain page is malicious or not. What's more, instead of using one page, hackers now utilize rotating websites, and this enables their phishing campaigns to live longer. So what can users do to notice fake websites?

Fake Site Trends

Security experts unanimously agree that it is becoming challenging to recognize fake websites. The phishing sites that try to steal sensitive information tend to look extremely realistic, and when you couple that with the sense of urgency that they use to trick innocent users, it might be rather difficult to say that a page is fake.

If you are used to a particular font or layout of some popular website, you might feel that the fake page is real even if you see the same color shade or the same logo. Therefore, it is no surprise that hackers impersonate such popular websites as Google, Facebook, Dropbox, PayPal, and others to lure important information from unsuspecting users.

Normally, it should be possible to tell that the page is fake by checking its URL. However, phishing attack developers know this, and they tend to use scripting tools to scramble their addresses, making it look like they are encrypted and safe. In this case, the thing that might catch your eye is the site's design. Although scammers may use the same color scheme and the same logos, the design could be outdated. So if you notice that the PayPal page you have opened looks different from the one you opened yesterday, it's the first sign that something is off.

Is It Possible to Avoid Phishing Attacks?

The sheer number of fraudulent sites clearly makes it hard even for security experts to come up with relevant and effective methods to contain this phishing epidemic. Not to mention that it is nearly impossible to keep track of the sites because they go offline really fast. The changes in phishing attack techniques call for new detection methods, and that is clearly one of the main challenges cyber security specialists face today. But what about regular users? Is there anything they can do to avoid such attacks?

Although it is becoming really hard to spot such attacks, there is still one thing that all of them share, and that is the sense of urgency. In other words, phishing attacks will gamble on your fears and emotions in order to trick you into giving away your sensitive information. More often than not, phishing messages imply that if you do not do something immediately, your entire world will collapse in an instant. Hence, the words you should look out for include "warning," "alert," "error," and so on. The language used in phishing messages and websites is designed to push you into action without giving you any time to think.

Hence, you have to remain calm even if someone claims that you have to tend to a certain urgent matter immediately. For example, before you disclose your sensitive information, you can always double-check whether the problem is is a real threat. If you are on PayPal, you can try accessing your account via another browser, or you can simply contact their customer service (and even provide them with the suspicious link!) asking whether you really have particular problems with your account.

No business would terminate your account in a matter of hours without double-checking with you several times before that. No one would want to lose a client just like that. Therefore, the best way to protect yourself from a phishing attack is to keep your head straight and always double-check whether the dire consequences described in a specific message are real. There's no need to dive head first into the phishing net.

November 12, 2018

Leave a Reply