Phishing Detection

New SSL certificates as they are issued (Certificate Transparency, our own CertStream server), the domains whose name speaks of logging in, and their pages checked for a login form. Live, left to right: what comes in, what the filter keeps, what was checked, the login pages, and the ones that look like phishing.

…
—
Filtered, last 24 h
—
Waiting for a site
—
No login form
—
No site
—
Login pages
—
Likely phishing
—
Bank words
—
Confirmed phishing
—
Not phishing (set aside)
Live

CertStream

—

    Login words in the name

    —

      Page checked

      —

        Login page

        A password field or a login form

          Likely phishing

          Login page plus suspicious signals
            Bank

            Bank words in the name

            bank, banking, banco, banca, banque, sparkasse, creditunion
            Your keyword sets
            Loading…
            Up to 3 sets, up to 300 words each, 3-63 characters (a-z, 0-9, -). A word of 6 letters or more counts anywhere in the registered name, so "binance" also catches mybinancewallet; a word of 5 letters or fewer only with no letter right beside it, so "ing" catches ing-login.de but not shopping.de. New certificates are matched within about 10 s; hosts already stored are tagged at once. With 3 sets, adding a new one deletes the set you choose.
            Hosts
            Loading…