Catching Phish Using Publicly Accessible Information

This short talk looks at how information that anyone can access publicly can help spot phishing sites and newly registered lookalike domains. The core problem is that attackers can stand up copies of a legitimate brand quickly, so defenders need early signals.

The speaker covers several sources. Certificate transparency logs reveal newly issued certificates and their alternative names, which can be monitored close to real time. Web server referrer headers show when other sites load images or static content directly from your infrastructure. Canary tokens placed on a site send an alert when someone copies or mimics it. Favicon hashes can be searched on internet scanning services to find where a brand's icon appears elsewhere. Fuzzy hashing of the HTML from a genuine page and a suspicious page gives a similarity score. Storing certificates, favicon hashes and related fields in a graph database helps link domains into campaigns, and a visualization tool helps inspect those links. Finally, DNS twisting generates permutations of a brand's domain and checks their start of authority records to see which have been registered.

The takeaway is that these methods are inexpensive and largely proactive, letting a team find lookalike infrastructure before it is used against customers. Combining several sources gives a more complete picture than relying on any single one.