Field Study

We identify phishing campaigns by grouping phishing webpages based on their targeted brands and similarities in domain names. The initial and final days of each campaign are plotted in the following figure. We identified 5 distinct phishing campaigns targeting SonicWall, Meta, Thales Group, EBSCO Information Services, and AVM Deutschland, respectively. On average, a phishing campaign lasts about 16 days. The longest campaign is the SonicWall campaign, which lasts for 28 days and continues until the end of our experiment.

Meta Campaign:
We observe a campaign targeting Meta, sharing several distinctive characteristics:
(i) Use of .click Top-Level Domain: All phishing webpages use the uncommon ".click" TLD.
(ii) Diverse Languages: Phishers prepare multilingual versions of the webpage for dissemination to victims from different countries.
(iii) Outdated Layout: The webpage layout is based on an outdated template of the Facebook login page.
(iv) Dynamic Logo Loading: The phishing webpage loads the logo dynamically via JavaScript, rather than directly using an img tag to point to the logo image. This approach decreases readability.
(v) Input Obfuscation: While legitimate Facebook pages use meaningful HTML attributes such as type='email' or id='pass' for their input fields, phishing pages assign random attributes to minimize readability.

SonicWall Campaign
We observe a phishing campaign targeting SonicWall, a cybersecurity company. The campaign includes the following observations:
(i) MyCloud Service Manipulation: They exploited the MyCloud service for hosting their websites.
(ii) Embedded Frame: Their HTML code loads an iframe pointing to "auth1.html", hosted by the phishers, which displays a credential-taking form.
(iii) Timeout Feature: The webpage includes a timeout mechanism that activates after about one minute, after which users are redirected to a page stating "Your login attempt has timed out".