Catching Phishers By Their Bait: Investigating the Dutch Phishing Landscape through Phishing Kit Detection

H.L.J. Bijmans, T.M. Booij, Anneke Schwedersky, Aria Nedgabat, R.S. van Wegberg

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

206 Downloads (Pure)


Off-the-shelf, easy-to-deploy phishing kits are believed to lower the threshold for criminal entrepreneurs going phishing. That is, the practice of harvesting user credentials by tricking victims into disclosing these on fraudulent websites. But, how do these kits impact the phishing landscape? And, how often are they used? We leverage the use of TLS certificates by phishers to uncover possible Dutch phishing domains aimed at the financial sector between September 2020 and January 2021. We collect 70 different Dutch phishing kits in the un- derground economy, and identify 10 distinct kit families. We create unique fingerprints of these kits to measure their preva- lence in the wild. With this novel method, we identify 1,363 Dutch phishing domains that deploy these phishing kits, and capture their end-to-end life cycle – from domain registration, kit deployment, to take-down. We find the median uptime of phishing domains to be just 24 hours, indicating that phishers do act fast. Our analysis of the deployed phishing kits reveals that only a small number of different kits are in use. We dis- cover that phishers increase their luring capabilities by using decoy pages to trick victims into disclosing their credentials. In this paper, we paint a comprehensive picture of the tac- tics, techniques and procedures (TTP) prevalent in the Dutch phishing landscape and present public policy takeaways for anti-phishing initiatives.
Original languageEnglish
Title of host publicationProceedings of the 30th USENIX Security Symposium
PublisherUSENIX Association
Number of pages18
ISBN (Print)978-1-939133-24-3
Publication statusPublished - 2021


Dive into the research topics of 'Catching Phishers By Their Bait: Investigating the Dutch Phishing Landscape through Phishing Kit Detection'. Together they form a unique fingerprint.

Cite this