## 3 The Proposed E-mail-Based Phishing Attack Taxonomy
However, other different techniques to generate a possible e-mail address (a person's credentials within different e-mail domain names, random sequences, etc.) are used too. * Ideas for victim involvement in the phishing attack is the main element of any social engineering attack. We define the main factors that make the victim believe it is a legitimate request and requested data have to be provided:
* Benefit proposal motivates the victim to provide requested data to get some financial or another benefit from it. However, in most cases, the promised benefit is not provided, while the gathered data are used for different purposes. * Impression of legitimate request does not involve additional questions requesting legitimacy, and the victim automatically sends the requested data. However, it is very difficult to generate such an e-mail text that provides a sufficient amount of detail about request management processes and internal data. * Impression of an important event. The information request leads to stress for the victim; therefore, some victims do not analyze the e-mail with sufficient attention and proceed with a hurry to execute the requested actions, providing the requested data. * Impression of a possible failure in the case of the data not being provided. This is a very similar strategy to the previous one as it activates the same emotions for the victim. At the same time, it is more focused on understanding the internal processes, as the attacker must know or imagine what kind of processes might be associated with failure if information is not provided by the victim. * Other strategies are possible too. The phishing attack is much harder to identify if it uses some very specific weaknesses of the victim, as the traditional phishing attack e-mail texts are well known and are easy to recognize as a phishing attack. * E-mail text generation strategy. In this strategy, the source defines how the e-mail text is generated. There are three main strategies:
* Generated--a new, case-specific phishing attack text. It might be time-consuming; however, is harder to identify it as a phishing attack by signature-based e-mail filtering systems. Edited--the e-mail text is copied from another e-mail (legitimate or phishing attack e-mail), and some parts of the e-mail are changed (replacing the name of the recipient, etc.). Duplicated--the e-mail text is copied from other sources and is not changed at all. * E-mail text can be created manually or by using automated solutions; therefore, we define two types of e-mail text creators:  
* Human--e-mail text is written or changed by the person. * A bot or computer--e-mail text is generated or modified by a computer program or bot. * E-mail text personalization level is closely related to the e-mail text generation strategy, and we define two types of personalization:  
* Not personalized--the e-mail text is very abstract, and no personal information is added in the e-mail. * Personalized--the e-mail text includes some personalized information about the recipient or the e-mail. The emails can be personalized by using publicly available data (such as recipient's name, surname, the title of the organization, etc.) or by using some specific knowledge (data about recent user's visits, financial operations, etc.). In other sources, the use of personalized phishing attacks with publicly available victim data is called spear phishing, while personalized phishing attacks that use some specific knowledge and are usually directed to some higher position persons are classed as whaling attacks. * The sender's e-mail address is one of the main factors in identifying a phishing attack. The attacker can use his real or spoofed e-mail address:
* A real e-mail address uses no specific techniques to change itself. The attacker might use hacked e-mail account or register and create an untraceable e-mail account for phishing e-mail distribution. * Spoofed e-mail addresses are changed to trick the victim by showing a specific e-mail address that is not possible to obtain legitimately.