What's Phishing Like In 2023?
Published: 2024-03-28 08:42:26

---
title: What's Phishing Like In 2023?
published: true
date: 2023-11-19 00:00:00 UTC
tags: 
canonical_url: https://www.tercmd.com/phishing-analysis-2023
cover_image: https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tudqpmnchzi55d6foqlb.png
---

I found a phishing filter ([here](https://malware-filter.gitlab.io/phishing-filter/phishing-filter.txt)) which can be used in content blockers (as well as adblockers) like uBlock Origin. I wanted to analyze the phishing links and this is the analysis.

## Popular Web Hosts

Who are the web hosts (and website builders) that are used the most often in the phishing websites examined?

1. Google for [Firebase Hosting](https://firebase.google.com/docs/hosting), with `2,428` unique websites. [^1]

2. Weebly (a free website builder), with `2,239` websites. [^2]

3. r2.dev, with `1,286` entries.  
 This refers to the R2 file storage offered by Cloudflare.

4. crazydomains.com (with their Sitebeat website builder), with `1,164` websites.  
 Interestingly, the domains I tested seemed to redirect to `global_errors.sitebeat.crazydomains.com` with a Coming Soon page (which is also in the filter list)

5. workers.dev (Cloudflare Workers), with `759` entries  
 Cloudflare Workers is a service which allows a user to run JavaScript on their edge nodes. I presume these could be proxies or returning hardcoded HTML. However, the code isnt visible so thats just speculation.

Just these 5 domains cover 66% of recognized hosting providers.

## Dynamic DNS

Dynamic DNS is a service where a fixed hostname maps to a dynamic IP address (like a home IP address) that updates regularly.

1. DuckDNS, with `138` entries.

2. DynDNS, with `20` entries.

3. ddns.net and ddnss.eu, with `1` entry each.

## Documents

This category consists of platforms that host documents, spreadsheets and presentations.

1. Google Docs, with `1,296` entries.  
 This includes 74 forms, 10 documents, 6 drawings, and 1,206 presentations.  
 Almost all presentations contain /pub? with some data as URL parameters. I'm not too sure what this does.  
 In addition, Google Drive has `9` entries.  
 Many of the URLs seem to be taken down, either by the owner or by Google.

2. telegra.ph, with `3` entries.

3. notion.site, with `2` entries.

## Forms

This consists of tools that allow users to build forms.

1. Microsoft Forms, with `62` forms.

2. forms.app, with `24` forms.

3. Google Forms (forms.gle), with `15` forms.

4. JotForm, with `11` forms.

5. formstack.com and hsforms.com, with `7` forms each.

## Scripts

There are `102` entries for script.google.com (Google Apps Script) which link to macros and running the script, sometimes with parameters to track the user that clicks.

## Government

There are 4 government domains, none of which _seem_ inherently malicious. The entire domain is blocked by the phishing filter.  
I'm not listing these domains here because the pattern is what matters, not an individual country.

## IP Addresses

`98` unique IP(v4) addresses (with 441 entries) exist in the phishing filter list.

(For the below information, ipinfo.io was used as a source)

### Top ASNs

ASNs (Autonomous System Numbers) are the organizations that own a block(s) of IP addresses to provide services to their customers (hosting providers, ISPs, some VPNs)

1. AS132203 Tencent Building, Kejizhongyi Avenue with `46` IP addresses.

2. AS14061 DigitalOcean, LLC and AS16276 OVH SAS with `5` IP addresses each.

3. AS396982 Google LLC with `4` IP addresses.

### Top Cities

1. Singapore with `40` IP addresses.

2. Santa Clara (California, US) with `9` IP addresses.

3. Beauharnois (Quebec, Canada) with `4` IP addresses.

## Link Shorteners

1. TinyURL, with `176` entries.

2. Bitly, with `161` entries.

3. Twitters link shortener (t.co) with `160` entries.

4. s.id with `115` entries.

5. t.ly with `33` entries.

## IPFS

IPFS is a Web3 technology that allows decentralized hosting of files. These are not directly accessible in a browser, but through gateways like those from Cloudflare, ipfs.io and others.

When I saw the numbers for IPFS, I was genuinely surprised.

1. From Cloudflare IPFS alone, there are `5,380` entries. [^3] (I also want to point out that [BleepingComputer has an article](https://www.bleepingcomputer.com/news/security/phishing-attacks-distributed-through-cloudflares-ipfs-gateway/) about Cloudflare's IPFS gateway being used for phishing attacks, showing its prominence.)

2. ipfs.io with `990` entries.

3. nftstorage.link with `805` entries.

4. dweb.link with `416` entries.

5. Infura IPFS with `366` entries.

## Evasion Methods

These are methods used such that the domain seems innocent but leads to another website (not including link shorteners).

1. VKontakte, with `39` entries this uses an away page that redirects to another website (an account on VKontakte is required).

2. google.com, with `22` entries[^4] with 13 URLs having the path /url?q=[insert a url-encoded url here] and `9` entries using AMP to have a Google domain, but with a phishing page. Theyre having their cake and eating it too.

3. translate.goog (Google Translate for websites), with `15` entries.

4. accounts.google.com, with `8` URLs, all of which contain continue= and followup= with URLs as the values. This redirects the user after theyre signed in.

## Uncategorized

There are `6,593` uncategorized domains.

1. `3058` domains use a .com TLD.

2. `437` domains use a .top TLD.

3. `217` domains use a .br TLD.

4. `200` domains use a .net TLD.

5. `186` domains use a .pl TLD.

6. `176` domains use a .xyz TLD.

7. `108` domains use a .org TLD.

## The Big Picture

![A diagram showing the different means for phishing outlined in this article. Website Hosting/Website Builders is at 11,800. IPFS is at 8,634. Documents is at 1,236. Link Shorteners is at 735. Forms is at 147. Dynamic DNS is at 160.](https://cdn.hashnode.com/res/hashnode/image/upload/v1705244377160/fdaa8dd3-9f7a-4954-a2ca-36acd0403f45.png)

[^1]: The filter list has more than 2,100 entries for both `firebaseapp.com` and `web.app`, due to the data sources of the filter list including both domains. Websites on both domains have been filtered down to just one, leading to the lower number. 

[^2]: Weebly has two domains which are `weebly.com` and `weeblysite.com` for hosted websites, in which none of the entries are duplicates. 

[^3]: This is across two domains (`cf-ipfs.com` and `cloudflare-ipfs.com`) with duplicate addresses removed. 

[^4]: There were `23` entries, but one of them was a search, so thats been excluded.