How to win (or at least not lose) the war on phishing? Enlist machine learning

StreamingPhish, a tool that identifies potential phishing sites by mining data on newly registered certificates, I’ve spotted an Apple phishing site before it’s even ready for victims. Conveniently, the operator has even left a Web shell wide open for me to watch him at work.

The site’s fully qualified domain name is appleld.apple.0a2.com, and there’s another registered at the same domain—appleld.applle.0a2.com. As I download the phishing kit, I take a look at the site access logs from within the shell. Evidently, I’ve caught the site just a few hours after the certificate was registered.

As I poke around, I find other phishing sites on the same server in other directories. One targets French users of the telecommunications company Orange; others have more generic names intended to disguise them as part of a seemingly legitimate URL, such as Secrty-ID.com-Logine-1.0a2.com. Others still are spam blogs filled with affiliate links to e-commerce sites.