PhishFarm: A Scalable Framework for Measuring the Effectivness of Evasion Techniques Against...

## Overview PhishFarm is a scalable framework for measuring the effectiveness of evasion techniques against modern anti-phishing blacklists, developed through collaboration between Arizona State University and PayPal. The research addresses a critical gap in understanding how phishing attacks bypass browser-based defenses. Phishing attacks rely on social engineering but are difficult to mitigate at scale due to an extensive ecosystem supporting their deployment. While browser blacklists—including Google Safe Browsing, Microsoft SmartScreen, and Opera's protection—represent a key defense mechanism, attackers actively employ evasion techniques to circumvent them.

## Research Methodology The study was conducted in two phases. Preliminary experiments deployed 400 sites (6-7 per technique, 10 entities each) to understand anti-phishing entity behavior and refine the testing approach. Full-scale experiments deployed approximately 2,000 sites (66 per technique, 4 batches per entity) with continuous monitoring. The framework enabled end-to-end automation: configuration, deployment to cloud infrastructure, reporting to anti-phishing entities, and real-time blacklist monitoring across desktop and mobile browsers. Researchers used both random and deceptive URLs. After disclosure meetings with browser vendors and anti-phishing providers, a written report was shared with other organizations.

## Cloaking Techniques Tested Six primary techniques were evaluated: (1) no cloaking (control), (2) mobile-targeting (Android/iOS), (3) geolocation-based filtering (US vs. non-US desktop), (4) real-world phishing kit data with IP addresses and user agents, (5) JavaScript-based rendering requirements, and (6) htaccess dataset fingerprinting. These techniques were chosen to represent real-world attacker practices and user populations.

## Key Findings Cloaking reduced the likelihood of blacklisting by approximately 50% and doubled the time to blacklisting. A critical finding was that iOS and Android cloaking techniques resulted in zero blacklisting—mobile users visiting mobile-targeted phishing sites received no warnings, while desktop blacklists did not protect mobile platforms. US-only geolocation filtering successfully bypassed Google Safe Browsing, and similar region-specific patterns emerged for other entities. Real-world phishing kit data was more likely to be blacklisted, possibly due to fingerprinting. JavaScript cloaking effectively delayed long-term blacklisting. Significant blacklist changes occurred after approximately 2 hours, with variation by entity.

## Monitoring Results Over 72 hours, the framework collected over 20,000 blacklist timestamps and recorded over 2 million web hits from security crawlers. Google Safe Browsing proved fastest at blacklisting, though coverage gaps existed on mobile. Microsoft SmartScreen was the only entity using proactive heuristics on page content and URLs without verifying content first. Limited data sharing occurred between Google and Microsoft, though clearinghouses like the aPWG facilitated some coordination. Opera showed very limited coverage.

## Security Implications and Outcomes Following disclosure to Google before September 2018, mobile blacklisting issues were addressed. Users visiting known malicious sites on mobile subsequently received proper warnings, and other cloaking techniques became more detectable. The research revealed that hosting providers took an average of 17 hours to respond to abuse reports, and remediation was often ineffective initially. The ease of automated phishing site generation means that even 24-hour mitigation windows provide little value to defenders, as attackers deploy hundreds of sites per hour.

## Recommendations Cloaking prolongs attacker opportunities, particularly with geo-specific filtering. Current mitigations are insufficiently fast. The researchers recommend improved blacklist and hosting infrastructure responses, continuous testing and verification of defenses, enhanced data sharing between entities, trusted reporting channels from phishing victims, and proactive detection techniques leveraging intelligence beyond content analysis. These should complement multi-layer strategies including two-factor authentication and user training.

## Takeaways PhishFarm demonstrates that evasion techniques significantly degrade blacklist effectiveness and revealed a critical protection gap on mobile platforms. The framework supports ongoing security testing and baseline verification. The research emphasizes the need for faster, more coordinated responses and proactive detection rather than reactive blacklisting alone.