## 4 Validation of the Proposed E-mail-based Phishing Attack Taxonomy
### Proposed E-mail-Based Phishing Attack Taxonomy Comparison with Existing Taxonomies  
To compare our proposed e-mail-based phishing attack taxonomy with other similar taxonomies, scientific papers and conference proceedings were analyzed. Publications were from the last 15 years in Clarivate Analytics Web of Science, Google Scholar and other scientific databases. From the gathered material only 27 papers were related to classification, taxonomy of phishing, social engineering attacks or their mitigation and solutions. Only 11 of these papers mention phishing e-mails, and only six of them were suitable for taxonomy comparison (papers on phishing countermeasures were eliminated). For comparison, we listed our proposed criteria and classes (only first level, without deeper classification) of e-mail-based phishing attacks and evaluated whether these criteria/classes are presented in the analyzed taxonomy (scientific paper). The results of the comparison are presented in Table 1. The sign \"+\" in the class row means the class is included in the analyzed taxonomy or is mentioned in the description, while the sign \"-\" means there is no mention of this class in the taxonomy. If several rows are merged, the sign \"+\" means the criterion is presented in the analyzed taxonomy and has all classes in it, while the sign \"-\" in the merged rows means the criteria is not mentioned in the analyzed taxonomy at all. The comparison with existing taxonomies shows that none of the analyzed taxonomies define phishing attack actions while waiting for the victims' response. In most cases, a phishing attack is understood as a non-systematic attack, with no combined actions to support the main phishing e-mail, while in real life strategies, systematic phishing attacks appear and include the usage of different media, the involvement of additional persons, etc. As none of the analyzed taxonomies provide data on systemic phishing attacks, additional actions of the same phishing attack could not be assigned as the same phishing attack and were treated as another one. This is not suitable or convenient for cybercrime investigators as without a link to or understanding of related actions, the full investigation is not possible. Another difference compared to the existing phishing attack taxonomies is that we detail six phases of the e-mail-based phishing attack, while the phases of e-mail address selection, content creation and gathered data usage are ignored by most of the other taxonomies (just one or two taxonomies detail these phases). Existing taxonomies do not dedicate enough attention to how the attacker prepares for the attack. Without e-mail addresses, the selection phase of cybercrime investigation would not be able to identify the first actions by trying randomly selected and non-existent victim addresses (incident-notating persons would get the information from e-mail system logs). As well as gathered data usage, information would be useful for cybercrime investigators,; therefore, it is useful to add in the taxonomy. In our proposed taxonomy's content creation phase we present personalized and not personalized e-mail content and divide personalized content into the personalized class when publicly available data are used and when the additional, secret information is used in the e-mail message. Such a description is simpler compared to spear-phishing and whaling attack titles; therefore, the taxonomy could be more intuitive to non-expert security personnel. The most common criterion to define a phishing attack is the environment for data gathering, where a phishing attack is associated with the spoofed web page and data submission in a web-based form. This criterion and the class are mentioned in all analyzed taxonomies, and in most cases, they do not present all possible environments to obtain a user's secret data. It is also worth mentioning that the gathered data are usually presented as secret data, and there are no details on what kinds of data are gathered during the phishing attack.