How Phishers Evade Traditional URL Scanners
Summary
CloudSEK describes how phishers use geofencing, user-agent and referrer checks, URL parameters, and embedded credentials to hide phishing pages from scanners, and how its XVigil FDF module tests for these techniques.
Key points
- Geofenced phishing pages may serve malicious content only to visitors from selected regions, redirecting other traffic to legitimate sites.
- User-agent filtering can restrict phishing pages to mobile devices, while referrer checks may hide content from direct visitors and scanners.
- Parameterized URLs can gate access to phishing content until a specific query string, token, or identifier is supplied.
- Embedding credentials before the @ symbol can make a phishing URL appear to begin with a trusted domain; the Mango example uses mangokl[.]com.
- CloudSEK says its XVigil Fake Domain Finder module tests across regional IPs, user agents, referrer headers, and parameterized URLs to uncover hidden phishing pages.
Article Details
- Topic
- Phishing evasion techniques used to bypass conventional URL scanners, including geo-fencing, user-agent and referer filtering, and parameter-based filtering.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | mangokl[.]com | Phishing domain impersonating Mango. |
| URL | hxxps[:]//mangokl[.]com | Deceptive phishing URL directing users to the phishing domain while displaying shop.mango.com before the @ symbol. |