Pith. sign in

REVIEW 5 major objections 6 minor 43 references

A Login Page Transparency and Visual Similarity Based Zero Day Phishing Defense Protocol

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A public log of login pages, guarded by visual similarity checks, could make look-alike phishing impossible to register.

desk verdict Genuinely new CT-style transparency idea for login pages, but the 'impossible' claim fails on the first-logger-wins race and the model's own false negatives. read the letter →

arxiv 2507.09564 v1 pith:7BKHEUIX submitted 2025-07-13 cs.CR

Gaurav Varshney , Akanksha Raj , Divya Sangwan , Sharif Abuadbba , Rina Mishra , Yansong Gao This is my paper · ORCID
classification cs.CR
keywords phishingpreventionloginpagetransparencysignedtimestamppubliclogservervisualsimilaritydetectionSiamesenetworkzero-daycertificate
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes a protocol-level defense against zero-day phishing: every login page must be publicly logged and issued a signed timestamp before any browser will render it. The public log server rejects any new page that visually resembles an already-logged page from a different domain, which the authors argue makes it impossible for an attacker to obtain a valid signed timestamp for a look-alike page. If the scheme works, look-alike phishing stops being a detection arms race and becomes an administrative failure, because the attacker cannot get the credential every browser demands. The protocol runs client-side through a new HTTP header, avoiding platform-specific changes or third-party extensions. The paper backs the claim with a prototype browser extension, a Siamese-network visual similarity model, and a new dataset of credential-requiring pages.

What carries the argument

The load-bearing mechanism is the Page Logging Phase combined with the Signed Page Timestamp (SPT). The PLS checks each submitted page against stored embeddings of already-logged pages using a triplet-trained Siamese Network Model (SNM); only visually distinct pages are logged and issued an SPT, an HTTP header carrying version, timestamp, log ID, and a PLS signature over the URL hash and page-content hash. The browser's rendering phase first detects whether a page is a login page using weighted keyword and input-field scoring, then requires the SPT, and on any verification failure falls back to sending the page screenshot to the PLS for an on-the-fly visual comparison. The SNM is what carries the impossibility claim, because it is the only component that recognizes a page as an impersonation at registration time.

What would settle it

Run the paper's adversarial generation scheme, which builds a generic login template with a target brand's logo and primary color placed in nine screen positions plus old-logo swaps, through the actual PLS registration pipeline and count how many of the resulting look-alikes receive SPTs; the reported recall of 0.873 predicts roughly one in eight will be logged, directly contradicting the claim that it is impossible for an attacker to register a deceptive look-alike page.

Watch

Extended reading notes

Core claim

The central claim is that a public, append-only log of login pages, analogous to certificate transparency for certificates, can make visual look-alike phishing impossible. On a page-logging request, the public log server (PLS) verifies domain ownership, computes an embedding of the submitted page with a Siamese network, and refuses to log any page whose embedding is close to a page from a different domain. Only logged pages receive a Signed Page Timestamp (SPT), and the browser renders a login page only when that SPT verifies. Because the attacker cannot register the look-alike page without triggering the similarity check, and because a page without a valid SPT is not rendered, the paper concludes that cloned login pages can be stopped at the first attempt, even for never-before-seen phishing pages.

Load-bearing premise

The entire impossibility claim rests on the visual-similarity model never missing a look-alike page, but the paper's own results report 88 false negatives out of 697 phishing test images: pages that slip through can still be logged and receive valid SPTs.

Editorial extensions

If this is right

  • If the protocol is correct, every credential-collecting page must carry a valid SPT, so a phishing page that slips through the visual check would still be blocked because it lacks verifiable proof of logging.
  • The fallback screenshot check turns SPT failures into a second line of defense, so small legitimate changes to a login page do not become a denial of service.
  • The defense is entirely client-side: a browser that enforces SPTs protects users without server cooperation, blacklist updates, or user training.
  • Zero-day look-alikes are addressed at registration time, before the first victim arrives, because the PLS refuses to log pages that resemble an existing domain's login page.
  • Measured overhead is modest in the common case: about 9% extra load time when the SPT verifies, 43% when the Siamese model must process a screenshot, and 381% more data transferred in the worst case.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the protocol inherits certificate transparency's first-logger-wins weakness; the paper never analyzes what happens if an attacker registers a look-alike page before the legitimate owner logs its page, in which case the legitimate page becomes the 'look-alike' and can be refused logging.
  • Editorial inference: at the reported recall of 0.873, roughly 88 of the 697 phishing test images would still pass the similarity check and obtain SPTs, so the impossibility claim holds only if the model never misses a look-alike in deployment, which the paper's own results contradict.
  • Editorial inference: the PLS becomes a centralized privacy and availability chokepoint; the paper itself notes that IP addresses seen in verification requests could reveal short-term browsing patterns, and a compromised PLS would undermine trust in the entire system.
  • Editorial inference: adoption faces a chicken-and-egg problem, because browsers only gain protection after enough sites register their login pages, and sites only benefit after browsers enforce SPTs; a transitional period where phishers log first and lock out legitimate owners appears likely.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes Page Transparency (PT), a certificate-transparency-inspired protocol for phishing prevention. Domain owners register login pages with a Public Log Server (PLS), which issues a Signed Page Timestamp (SPT) after checking the page's visual similarity against previously logged pages using a Siamese network. Clients are expected to refuse login pages that lack a valid SPT or fail a secondary visual check. The paper describes the protocol, a threat model, a prototype browser extension, and experiments on login-page detection (precision 0.971) and Siamese-network similarity detection (recall 0.873). The central claim, stated in the abstract and Section 3, is that it becomes impossible for an attacker to register a deceptive look-alike page on the PLS and receive the cryptographic proof required for client verification.

Significance. The idea of extending Certificate Transparency to login pages is conceptually interesting, and the paper contributes a new dataset of 91 brands' login pages and a working prototype browser extension. However, the central security claim is unsupported. The protocol's own evaluation admits 88 false negatives in the similarity check, and more fundamentally the PLS only compares a submitted page against pages that were logged earlier, so an attacker who logs a look-alike page before the legitimate owner can obtain a valid SPT. The SPT generation and verification algorithms are inconsistent as written. The thresholds used in the evaluation are fitted on the same data used to report performance, so the reported numbers cannot be taken as predictive of real-world security. If the protocol worked, it would be a meaningful step toward proactive phishing defense, but the version presented here does not establish that guarantee.

major comments (5)
  1. [Section 3.1 (Page Logging Phase)] The PLS compares a submitted page's embedding only against embeddings of previously registered login pages. There is no bootstrap step or temporal ordering that guarantees the legitimate domain has logged its page before an attacker submits a look-alike. An attacker who registers first—hosting a clone on an attacker-owned domain and passing certificate-based domain ownership—will find no similar page in the log and will receive a valid SPT; the legitimate owner's later submission may then be rejected as visually similar to the attacker's already-logged page. This first-logger-wins race contradicts the abstract's claim that it is 'impossible' for an attacker to register a deceptive look-alike page and obtain a valid proof, and it is a logical flaw independent of the Siamese network's accuracy.
  2. [Section 6.2 and Table 2] The siameseThreshold is described only as an 'experimented threshold' and its numeric value is never reported, but it is central to the PLS decision to accept or reject a page. More seriously, the threshold appears to be selected using the same 697 phishing images and 50 legitimate images on which recall (0.873) and precision (1.0) are reported. Similarly, in Section 6.1, the login keyword weights and the loginThreshold are tuned on the same 103 or 105 websites used to report precision of 0.971. This circular evaluation overstates the models' performance and provides no evidence for the security claim that look-alike pages will be rejected by the PLS.
  3. [Section 3.1.3, Algorithms 1 and 3] Algorithm 1 signs struct_data_to_sign (version, timestamp, hashed_url, hashed_page) directly with the PLS private key. Algorithm 3, however, packs the same fields, computes SHA256_hash(packed_data), and verifies the signature against that hash. As written, an SPT produced by Algorithm 1 would not verify under Algorithm 3, because the signature is over the struct rather than over the SHA-256 hash of the packed data. This is a protocol-level inconsistency that breaks the core client-side verification flow.
  4. [Table 3 (Visual Similarity Evasion) and Section 6.2] The threat model states that the SNM 'can correctly detect a smart variation of the page by an attacker and deny it for logging over PLS.' Yet Section 6.2 reports 88 false negatives out of 697 phishing test images (recall 0.873). These false negatives mean that a substantial fraction of look-alike pages would not be flagged as similar to already-logged pages and would therefore be eligible to receive a valid SPT. The paper provides no analysis of how this false-negative rate affects the impossibility claim and does not bound the probability that a phishing page obtains a valid proof. The threat model as stated is contradicted by the paper's own experimental results.
  5. [Table 3 (PLS Compromise) and Section 7] The threat model lists 'PLS Compromise' as 'NA' with no mitigation, while Section 7 acknowledges that 'any compromise of PLS will affect the trust of the complete system.' Since the PLS is the trust anchor that signs SPTs, a compromised PLS can issue valid SPTs for arbitrary phishing pages, and clients would accept them. The paper offers no mechanism—such as append-only logs, multiple independent PLSs, or a monitor akin to Certificate Transparency—to detect or recover from a malicious or compromised PLS. This is a central gap in the threat model for a protocol whose entire security rests on the PLS.
minor comments (6)
  1. [Title page footnotes] The title-page footnotes contain unrelated text about polaritons on a cuprous oxide slab and polystyrene micro-spheres, which appears to be leftover template content and should be removed.
  2. [Figure 1] Figure 1 contains garbled text and appears to duplicate Figure 2; the body text refers to the 'attack lifecycle' but never references Figure 1 explicitly.
  3. [Section 3.2 and Table 2] The value of loginThreshold is inconsistent: Table 2 says it is set to 76, while the text says 'we have kept the threshold at 75' and Algorithm 2 does not specify a numeric value.
  4. [Section 6.2] The siameseThreshold value is never reported, despite being load-bearing for the PLS decision; the paper should state the value and how it was chosen.
  5. [References] References 'Azeez et al., 2021a' and 'Azeez et al., 2021b' are identical; the duplicate should be merged or removed.
  6. [Abstract and Section 4] The abstract states that 'all implementations occur on the client side,' but the protocol requires a PLS, domain-owner cooperation, and a browser extension; this wording is misleading.

Circularity Check

2 steps flagged · score 6.0 of 10

The 'impossible to register a look-alike' guarantee reduces to two ML thresholds (siameseThreshold, loginThreshold) fit post hoc to the same evaluations used to report the supporting detection metrics; the SPT/crypto machinery itself is self-contained.

  1. fitted input called prediction [Sections 3.1, 3.1.2, 6.2; Table 2 (siameseThreshold)]
    "This model generates embeddings of each page and classifies them as visually similar, if the similarity score between the embeddings exceeds a predetermined threshold derived from experimental results. ... Using our trained model over the training dataset described earlier and with an experimented threshold, out of the 697 phishing images, 609 are correctly identified as phishing, resulting in 609 true positives (TP). ... We finally received a Precision of 1, a Recall of 0.873, and an F1 Score of 0.932."

    The PLS's sole anti-look-alike rule—refuse to log a page whose embedding distance to an already-logged page of another domain falls below siameseThreshold—is the entire basis for the abstract's 'impossible' claim. The threshold is 'derived from experimental results,' and the only evaluation reported is on the same 697 phishing plus 50 unseen legitimate images on which the threshold was experimented, with no validation split or external benchmark. The reported recall 0.873 and precision 1.0 are in-sample operating-point measurements: the fitted threshold forces the detection rates later presented as evidence of the mechanism's effectiveness.

  2. fitted input called prediction [Sections 3.2 and 6.1; Table 2 (loginThreshold); Algorithm 2]
    "We have kept the threshold at 75 based on the experimentation we did with 105 websites. ... We tested our proposed login page detection algorithm over 103 unique webpages ... TP:67, TN:34, FP:2, FN:0. Precision of our login page detection algorithm comes to be equal to 0.971 and accuracy comes as 0.981."

    Every browser-side protection step—SPT presence check and the fallback SNM query—is gated on is_Login_Page, and Table 3 says the 'Phishing Page Rendering Bypass' threat is 'mitigated using our proposed advanced login page detection algorithm.' That algorithm's threshold and keyword weights were tuned by 'experimentation we did with 105 websites,' and the precision 0.971 is then reported on 103 webpages drawn from the same site population, with no held-out benchmark. The 0.971 precision is thus a fit report rather than an independent prediction of detection performance, and the security property that depends on it inherits the in-sample tuning. Minor inconsistency: Table 2 states the loginThreshold is 76 while the text says 75.

full rationale

The protocol's cryptographic machinery—SPT generation (Algorithm 1), signature verification (Algorithm 3), public logID lookup, and the CT-inspired logging design—is self-contained and not circular in any way. There is no load-bearing self-citation: the cited Varshney prior works are related-work surveys and detectors, not premises of the security claim. The circularity, which is partial, sits in the two classifiers that carry the security guarantee. The PLS look-alike refusal rule (siameseThreshold) and the browser login-page trigger (loginThreshold) are both fit to the very evaluations later reported as evidence (Sections 4, 6.1, 6.2), so the 'prediction' that attackers cannot obtain SPTs for look-alikes statistically reduces to the fitted operating points. The abstract's 'impossible' wording is additionally contradicted by the paper's own in-sample recall of 0.873 (88 false negatives) and by the first-logger-wins bootstrap gap (Section 3.1 compares only against previously logged pages); I do not count those as circularity since they are correctness and security flaws rather than reductions of outputs to inputs. Because the central impossibility claim's evidence is in-sample while the protocol itself has independent content, the score is 6 rather than 8-10.

Assumptions & free parameters 4 free parameters · 4 assumptions · 3 invented entities

The protocol's security depends on an honest PLS, universal browser enforcement, and the visual similarity model catching every look-alike page. The two thresholds and keyword weights are fitted to the authors' own dataset, and the PLS compromise case is explicitly left unaddressed. These are the main unvalidated assumptions underlying the central claim.

free parameters (4)
  • loginThreshold = 76 (text also says 75)
    Threshold above which a page is classified as a login page; set based on experiments with 105 websites (Section 3.2, Table 2).
  • siameseThreshold = not reported numerically
    Similarity threshold for visual matching, described as 'experimentally determined' (Sections 3.2, 6.2).
  • login keyword weights = 10 per keyword, 30 URL, 15 submit, 60 input
    Hand-chosen weights tuned on the authors' dataset (Algorithm 2, Section 3.2).
  • Siamese network parameters = not specified
    Model architecture borrowed from VisualPhishNet; training details omitted, so the model itself is a fitted artifact (Section 3.1.2).
assumptions (4)
  • domain assumption The PLS is honest and uncompromised.
    The threat model lists 'PLS Compromise' with mitigation 'NA' (Table 3), yet the entire trust anchor is the PLS.
  • ad hoc to paper All legitimate login pages are logged before any attacker tries to log a look-alike.
    The protocol only refuses the second page of two visually similar pages; first-come-first-served is never stated or defended (Section 3.1).
  • standard math X.509 certificate validation correctly binds a domain to its owner.
    Domain ownership check in the Page Logging Phase relies on standard public key certificate validation (Section 3.1).
  • domain assumption Browsers will be modified to enforce SPT presence for all login pages.
    The protocol requires browser-level enforcement, which the paper only prototypes as an extension (Section 4).
invented entities (3)
  • Public Log Server (PLS)
    purpose: Central registry that stores login page embeddings and issues SPTs
    A new system component proposed by the paper; no external validation.
  • Signed Page Timestamp (SPT)
    purpose: Cryptographic proof that a page was logged; carried in a custom HTTP header
    New protocol message, analogous to CT's SCT; only exists within the proposed protocol.
  • Page Transparency (PT)
    purpose: Concept of publicly logging login pages for client verification
    Named concept proposed by the paper; no independent evidence.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Login Page Transparency and Visual Similarity Based Zero Day Phishing Defense Protocol." pith.science (2026). https://pith.science/paper/7BKHEUIX

@misc{pith2026250709564,
  author       = {Pith},
  title        = {Pith review of: A Login Page Transparency and Visual Similarity Based Zero Day Phishing Defense Protocol},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7BKHEUIX}},
  note         = {Machine review of arXiv:2507.09564}
}
read the original abstract

Phishing is a prevalent cyberattack that uses look-alike websites to deceive users into revealing sensitive information. Numerous efforts have been made by the Internet community and security organizations to detect, prevent, or train users to avoid falling victim to phishing attacks. Most of this research over the years has been highly diverse and application-oriented, often serving as standalone solutions for HTTP clients, servers, or third parties. However, limited work has been done to develop a comprehensive or proactive protocol-oriented solution to effectively counter phishing attacks. Inspired by the concept of certificate transparency, which allows certificates issued by Certificate Authorities (CAs) to be publicly verified by clients, thereby enhancing transparency, we propose a concept called Page Transparency (PT) for the web. The proposed PT requires login pages that capture users' sensitive information to be publicly logged via PLS and made available to web clients for verification. The pages are verified to be logged using cryptographic proofs. Since all pages are logged on a PLS and visually compared with existing pages through a comprehensive visual page-matching algorithm, it becomes impossible for an attacker to register a deceptive look-alike page on the PLS and receive the cryptographic proof required for client verification. All implementations occur on the client side, facilitated by the introduction of a new HTTP PT header, eliminating the need for platform-specific changes or the installation of third-party solutions for phishing prevention.

Figures

Figures reproduced from arXiv: 2507.09564 by the authors.

Figure 1
Figure 1. Phishing Attack Lifecycle engines using a combination of elements such as the title, domain, copyright information, favicon, keywords, and logos to identify phishing sites Chiew, Choo, Sze and Yong (2018). Later, heuristic and machine learning (ML)-based solutions were introduced, which extract features from HTML content, DOM structure, and the URL Prasad and Dondeti (2025); Reggi Tresna Utami, Hilman and Yazid (202… view at source ↗
Figure 2
Figure 2. Overall Architecture arbitrarily by attackers on the internet which are most of the times happen to be login pages or important pages of site where the attacker is interested in stealing form data. The pages if considered to be certificates and phishers as CA one can use the concept of login page transparency by logging all login pages of a website in a publicly verifiable log to see if an attacker has also not crea… view at source ↗
Figure 3
Figure 3. Page Logging Phase phishing, 115 legitimate, and 50 unseen legitimate login webpage screenshots, with a primary focus on Alexa’s top websites that are the major victims of phishing attacks. This targeted approach enhances the model’s ability to effectively detect and differentiate phishing websites based on visual similarity, especially in cases where user credentials are being targeted. To train SNM, we created a d… view at source ↗
Figures from the paper (19 more)
Figure 4
Figure 4. Figure 4: In first row image (a) representing original Sign In page of netflix, image (b) representing shift(-200,50), image (c) representing shift(-200,-200). In second row image (d) representing Gaussian Noise, image (e) representing Brightening and image (f) representing Dark…
Figure 5
Figure 5. Figure 5: SPT Header and its Hexadecimal representation Varshney et al.: Preprint submitted to Elsevier Page 8 of 21 [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: logID of PLS [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Page Rendering Phase [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: Comprehensive communication among all entities Algorithm 4: Working of Browser Extension Used for Prototype Deployment 1: function Event Listener for chrome.webRequest.onHeadersReceived 2: headers = response headers 3: end function 4: function Event Listener for chrome…
Figure 9
Figure 9. Figure 9: Performance parameters out of 697 phishing and 50 unseen legitimate images TN:34, FP:2, FN:0. Precision of our login page detection algorithm comes to be equal to 0.971 and accuracy comes as 0.981. 6.2. Siamese Network Model For training our model, we used 115 legitima…
Figure 10
Figure 10. Figure 10: SNM Time Complexity Amazon, Atlassian, Booking, Bookmyshow, Chase, Cnn, Mediafire, Msn, Indeed, Quora, Researchgate, Roblox, Sar￾aliitjammu, Soundcloud, Steamcommunity, Swiggy, The￾guardian, Thenewyorktimes, Twitch, Walmart, Wetransfer, Zoom. To generate phishing-like…
Figure 11
Figure 11. Figure 11: Latency 324.5 0 0 354.75 30.25 9 464.43 139.93 43 0 50 100 150 200 250 300 350 400 450 500 Time Taken in ms Time overhead in ms Time overhead in % Time Overhead Normal Website Website with spt header and signature verified Website with spt header and signature unverif…
Figure 14
Figure 14. Figure 14: Packets captured through Wireshark • Client & Server Instance3 : This is communication re￾quired for the SNM model processing when signature validation for a page fails. We captured the packets of these communications using Wireshark [PITH_FULL_IMAGE:figures/full_fig…
Figure 15
Figure 15. Figure 15: Page Logging by PLS The process begins with the domain owner, which initiates a request to the PLS. This step is depicted in [PITH_FULL_IMAGE:figures/full_fig_p020_15.png]
Figure 16
Figure 16. Figure 16: Logging request by Domain Owner to PLS logs the page then it returns an SPT as a response to the request of the domain owner. This response is shown in 19. 8.2. Implementation of Phase 2 Now, we discuss implementation of "AntiPhish" browser extension. We have these sc…
Figure 17
Figure 17. Figure 17: Domain Owner Request Payload [PITH_FULL_IMAGE:figures/full_fig_p022_17.png]
Figure 18
Figure 18. Figure 18: Siamese Model Server Request Handling [PITH_FULL_IMAGE:figures/full_fig_p022_18.png]
Figure 19
Figure 19. Figure 19: Received SPT Header - Varshney et al.: Preprint submitted to Elsevier Page 22 of 21 [PITH_FULL_IMAGE:figures/full_fig_p022_19.png]
Figure 20
Figure 20. Figure 20: Login Page with no SPT Header present [PITH_FULL_IMAGE:figures/full_fig_p023_20.png]
Figure 21
Figure 21. Figure 21: Non Login Page [PITH_FULL_IMAGE:figures/full_fig_p023_21.png]
Figure 22
Figure 22. Figure 22: Signature Unverified and declared Phishing [PITH_FULL_IMAGE:figures/full_fig_p023_22.png]
Figure 23
Figure 23. Figure 23: Signature Unverified and declared Non Phishing [PITH_FULL_IMAGE:figures/full_fig_p023_23.png]
Figure 24
Figure 24. Figure 24: Signature Verified Varshney et al.: Preprint submitted to Elsevier Page 23 of 21 [PITH_FULL_IMAGE:figures/full_fig_p023_24.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

43 extracted references · 41 canonical work pages

  1. [1]

    , author Krombholz, K

    author Abdelnabi, S. , author Krombholz, K. , author Fritz, M. , year 2019 . title Whitenet: Phishing website detection by visual whitelists . journal arXiv preprint arXiv:1909.00300

    arXiv 2019

  2. [2]

    , author Krombholz, K

    author Abdelnabi, S. , author Krombholz, K. , author Fritz, M. , year 2020 . title Visualphishnet: Zero-day phishing website detection by visual similarity , in: booktitle Proceedings of the 2020 ACM SIGSAC conference on computer and communications security , pp. pages 1681--1698

    work page 2020

  3. [3]

    , author Mustafa, S

    author Aijaz, U. , author Mustafa, S. , author Misbahuddin, D.M. , year 2021 . title D-ts: A secure and trusted authentication framework for domain name server . journal International Journal of Wireless and Microwave Technologies volume 11 , pages 30--45

    work page 2021

  4. [4]

    title Phishing Activity Trends Report: 2nd Quarter 2024

    author APWG , year 2024 . title Phishing Activity Trends Report: 2nd Quarter 2024 . type Technical Report . APWG. https://docs.apwg.org/reports/apwg_trends_report_q2_2024.pdf. note accessed: 2024-09-10

    work page 2024

  5. [5]

    , author Zan, C.T

    author Aung, E.S. , author Zan, C.T. , author Yamana, H. , year 2019 . title A survey of url-based phishing detection , in: booktitle DEIM forum , pp. pages G2--3

    work page 2019

  6. [6]

    , author Misra, S

    author Azeez, N.A. , author Misra, S. , author Margaret, I.A. , author Fernandez-Sanz, L. , et al., year 2021 a. title Adopting automated whitelist approach for detecting phishing attacks . journal Computers & Security volume 108 , pages 102328

    work page 2021

  7. [7]

    , author Misra, S

    author Azeez, N.A. , author Misra, S. , author Margaret, I.A. , author Fernandez-Sanz, L. , et al., year 2021 b. title Adopting automated whitelist approach for detecting phishing attacks . journal Computers & Security volume 108 , pages 102328

    work page 2021

  8. [8]

    , author Maroofi, S

    author Bayer, J. , author Maroofi, S. , author Hureau, O. , author Duda, A. , author Korczynski, M. , year 2023 . title Building a resilient domain whitelist to enhance phishing blacklist accuracy , in: booktitle 2023 APWG Symposium on Electronic Crime Research (eCrime) , organization IEEE . pp. pages 1--14

    work page 2023

Show all 43 references
  1. [9]

    , author A \" meur, E

    author Belabed, A. , author A \" meur, E. , author Chikh, A. , year 2012 . title A personalized whitelist approach for phishing webpage detection , in: booktitle 2012 Seventh International Conference on Availability, Reliability and Security , organization IEEE . pp. pages 249--254

    2012

  2. [10]

    , author Komisarczuk, P

    author Bell, S. , author Komisarczuk, P. , year 2020 . title An analysis of phishing blacklists: Google safe browsing, openphish, and phishtank , in: booktitle Proceedings of the Australasian Computer Science Week Multiconference , pp. pages 1--11

    2020

  3. [11]

    , author Han, W

    author Cao, Y. , author Han, W. , author Le, Y. , year 2008 . title Anti-phishing based on automated individual white-list , in: booktitle Proceedings of the 4th ACM workshop on Digital identity management , pp. pages 51--60

    2008

  4. [12]

    , author Choo, J.S.F

    author Chiew, K.L. , author Choo, J.S.F. , author Sze, S.N. , author Yong, K.S. , year 2018 . title Leverage website favicon to detect phishing websites . journal Security and communication networks volume 2018 , pages 7251750

    2018

  5. [13]

    , year 2024

    author Corp, I.S. , year 2024 . title Incivit . howpublished https://www.invicti.com/support/login-page-identifier/ . note Accessed: 2025-01-13

    2024

  6. [14]

    , author Wazan, A.S

    author Dadi, S.W. , author Wazan, A.S. , author Taj, I. , year 2024 . title Authenticating https connection without relying on certification authorities , in: booktitle 2024 15th Annual Undergraduate Research Conference on Applied Computing (URC) , organization IEEE . pp. pages 1--7

    2024

  7. [15]

    , author Eni s er, H.F

    author Fasllija, E. , author Eni s er, H.F. , author Pr \"u nster, B. , year 2019 . title Phish-hook: Detecting phishing certificates using certificate transparency logs , in: booktitle Security and Privacy in Communication Networks: 15th EAI International Conference, SecureCo...

    2019

  8. [16]

    , author Jain, A.K

    author Gupta, B.B. , author Jain, A.K. , year 2020 . title Phishing attack detection using a search engine and heuristics-based technique . journal Journal of Information Technology Research (JITR) volume 13 , pages 94--109

    2020

  9. [17]

    , author Cao, Y

    author Han, W. , author Cao, Y. , author Bertino, E. , author Yong, J. , year 2012 . title Using automated individual white-list to protect web digital identities . journal Expert Systems with Applications volume 39 , pages 11861--11869

    2012

  10. [18]

    , author Kim, T

    author Hong, J. , author Kim, T. , author Liu, J. , author Park, N. , author Kim, S.W. , year 2020 . title Phishing url detection with lexical features and blacklisted domains . journal Adaptive autonomous secure cyber systems , pages 253--267

    2020

  11. [19]

    , author Kim, H

    author Huh, J.H. , author Kim, H. , year 2012 . title Phishing detection with popular search engines: Simple and effective , in: booktitle Foundations and Practice of Security: 4th Canada-France MITACS Workshop, FPS 2011, Paris, France, May 12-13, 2011, Revised Selected Papers...

    2012

  12. [20]

    , author Gupta, B.B

    author Jain, A.K. , author Gupta, B.B. , year 2016 a. title A novel approach to protect against phishing attacks at client side using auto-updated white-list . journal EURASIP Journal on Information Security volume 2016 , pages 1--11

    2016

  13. [21]

    , author Gupta, B.B

    author Jain, A.K. , author Gupta, B.B. , year 2016 b. title A novel approach to protect against phishing attacks at client side using auto-updated white-list . journal EURASIP Journal on Information Security volume 2016 , pages 1--11

    2016

  14. [22]

    , year 2014

    author Laurie, B. , year 2014 . title Certificate transparency: Public, verifiable, append-only logs . journal Queue volume 12 , pages 10–19

    2014

  15. [23]

    , author Lee, K.C

    author Lee, L.H. , author Lee, K.C. , author Chen, H.H. , author Tseng, Y.H. , year 2014 . title Poster: Proactive blacklist update for anti-phishing , in: booktitle Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security , pp. pages 1448--1450

    2014

  16. [24]

    , author Berki, E

    author Li, L. , author Berki, E. , author Helenius, M. , author Ovaska, S. , year 2014 . title Towards a contingency approach with whitelist-and blacklist-based anti-phishing applications: what do usability tests indicate? journal Behaviour & Information Technology volume 33 ,...

    2014

  17. [25]

    , author Helenius, M

    author Li, L. , author Helenius, M. , author Berki, E. , year 2012 . title A usability test of whitelist and blacklist-based anti-phishing application , in: booktitle Proceeding of the 16th International Academic MindTrek Conference , pp. pages 195--202

    2012

  18. [26]

    , author He, Y

    author Li, W. , author He, Y. , author Wang, Z. , author Alqahtani, S.M. , author Nanda, P. , year 2023 . title Uncovering flaws in anti-phishing blacklists for phishing websites using novel cloaking techniques. , in: booktitle SECRYPT , pp. pages 813--821

    2023

  19. [27]

    , author Lee, J.H

    author Liu, D.J. , author Lee, J.H. , year 2024 . title A cnn-based sia screenshot method to visually identify phishing websites . journal Journal of Network and Systems Management volume 32 , pages 8

    2024

  20. [28]

    , author Mustafa, A.S

    author N, U.A. , author Mustafa, A.S. , author Misbahuddin, M. , year 2021 . title Tdane: Mechanism for validation of domain certificates for trusted browsing . journal 2021 5th International Conference on Intelligent Computing and Control Systems (ICICCS) , pages 1--8

    2021

  21. [29]

    , author Kumar, M

    author Prakash, P. , author Kumar, M. , author Kompella, R.R. , author Gupta, M. , year 2010 . title Phishnet: predictive blacklisting to detect phishing attacks , in: booktitle 2010 Proceedings IEEE INFOCOM , organization IEEE . pp. pages 1--5

    2010

  22. [30]

    , author Dondeti, V

    author Prasad, Y.B. , author Dondeti, V. , year 2025 . title Pdsmv3-dcrnn: A novel ensemble deep learning framework for enhancing phishing detection and url extraction . journal Computers & Security volume 148 , pages 104123

    2025

  23. [31]

    , author Pais, A.R

    author Rao, R.S. , author Pais, A.R. , year 2017 . title An enhanced blacklist method to detect phishing websites , in: booktitle Information Systems Security: 13th International Conference, ICISS 2017, Mumbai, India, December 16-20, 2017, Proceedings 13 , organization Springe...

    2017

  24. [32]

    , author Pais, A.R

    author Rao, R.S. , author Pais, A.R. , year 2019 . title Jail-phish: An improved search engine based phishing detection system . journal Computers & Security volume 83 , pages 246--267

    2019

  25. [33]

    , year 2021

    author Rathore, S. , year 2021 . title Detection of Web-based Phishing URL using Machine Learning, Whitelist and Blacklist approach . Ph.D. thesis. Dublin, National College of Ireland

    2021

  26. [34]

    , author Hilman, M.H

    author Reggi Tresna Utami, M. , author Hilman, M.H. , author Yazid, S. , year 2025 . title Enhancing phishing detection: Integrating xgboost with feature selection techniques . journal Muhammad Hafizhuddin and Yazid, Setiadi, Enhancing Phishing Detection: Integrating Xgboost w...

    2025

  27. [35]

    , author Watanabe, T

    author Sakurai, Y. , author Watanabe, T. , author Okuda, T. , author Akiyama, M. , author Mori, T. , year 2020 . title Discovering httpsified phishing websites using the tls certificates footprints , in: booktitle 2020 IEEE European Symposium on Security and Privacy Workshops ...

    2020

  28. [36]

    , author Wardman, B

    author Sheng, S. , author Wardman, B. , author Warner, G. , author Cranor, L. , author Hong, J. , author Zhang, C. , year 2009 . title An empirical analysis of phishing blacklists . journal Carnegie Mellon University

    2009

  29. [37]

    , author Kvet, M

    author Skula, I. , author Kvet, M. , year 2023 . title Domain blacklist efficacy for phishing web-page detection over an extended time period , in: booktitle 2023 33rd Conference of Open Innovations Association (FRUCT) , organization IEEE . pp. pages 257--263

    2023

  30. [38]

    , author Kumawat, R

    author Varshney, G. , author Kumawat, R. , author Varadharajan, V. , author Tupakula, U. , author Gupta, C. , year 2024 . title Anti-phishing: A comprehensive perspective . journal Expert Systems with Applications volume 238 , pages 122199

    2024

  31. [39]

    , author Misra, M

    author Varshney, G. , author Misra, M. , author Atrey, P.K. , year 2016 . title A phish detector using lightweight search features . journal Computers & Security volume 62 , pages 213--228

    2016

  32. [40]

    , author Agrawal, R

    author Wang, Y. , author Agrawal, R. , author Choi, B.Y. , year 2008 . title Light weight anti-phishing with user whitelisting in a web browser , in: booktitle 2008 IEEE region 5 conference , organization IEEE . pp. pages 1--4

    2008

  33. [41]

    , author Hong, J

    author Xiang, G. , author Hong, J. , author Rose, C.P. , author Cranor, L. , year 2011 . title Cantina+ a feature-rich machine learning framework for detecting phishing web sites . journal ACM Transactions on Information and System Security (TISSEC) volume 14 , pages 1--28

    2011

  34. [42]

    , author Hong, J.I

    author Zhang, Y. , author Hong, J.I. , author Cranor, L.F. , year 2007 . title Cantina: a content-based approach to detecting phishing web sites , in: booktitle Proceedings of the 16th international conference on World Wide Web , pp. pages 639--648

    2007

  35. [43]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.