https://wiki.sha2017.org/index.php?action=history&feed=atom&title=Lightning%3ADetecting_phishing_domains 2026-04-24T17:47:53Z Revision history for this page on the wiki MediaWiki 1.27.3 https://wiki.sha2017.org/index.php?title=Lightning:Detecting_phishing_domains&diff=10671&oldid=prev 2017-08-05T16:51:34Z

<p></p> <table class="diff diff-contentalign-left" data-mw="interface"> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;' lang='en'> <td colspan='2' style="background-color: white; color:black; text-align: center;">← Older revision</td> <td colspan='2' style="background-color: white; color:black; text-align: center;">Revision as of 16:51, 5 August 2017</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l2" >Line 2:</td> <td colspan="2" class="diff-lineno">Line 2:</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>|Is organized by=Sha2017.org-hackman</div></td><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>|Is organized by=Sha2017.org-hackman</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>|Has orga contact=mm@siteground.com</div></td><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>|Has orga contact=mm@siteground.com</div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">|Has website=http://www.siteground.com/</ins></div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>|Has description=How can you detect if a domain or a sub-domain is used for phishing?</div></td><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>|Has description=How can you detect if a domain or a sub-domain is used for phishing?</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>After analyzing a little more then 2milion dns records we hatched a plan to detect if a hostname is used for phishing using a little bit of AI.</div></td><td class='diff-marker'>&#160;</td><td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>After analyzing a little more then 2milion dns records we hatched a plan to detect if a hostname is used for phishing using a little bit of AI.</div></td></tr> </table>

Sha2017.org-hackman https://wiki.sha2017.org/index.php?title=Lightning:Detecting_phishing_domains&diff=10670&oldid=prev 2017-08-05T16:47:16Z

<p>Created page with &quot;{{Lightning |Is organized by=Sha2017.org-hackman |Has orga contact=mm@siteground.com |Has description=How can you detect if a domain or a sub-domain is used for phishing? Afte...&quot;</p> <p><b>New page</b></p><div>{{Lightning<br /> |Is organized by=Sha2017.org-hackman<br /> |Has orga contact=mm@siteground.com<br /> |Has description=How can you detect if a domain or a sub-domain is used for phishing?<br /> After analyzing a little more then 2milion dns records we hatched a plan to detect if a hostname is used for phishing using a little bit of AI.<br /> |Has lightning tag=Security, Phishing, DNS, AI, artificial intelligence<br /> |Has duration=5<br /> |Has desired session=Day 3<br /> |Held in language=en - English<br /> }}<br /> I'm the Chief System Architect of Siteground and I'm sick of all of the complains we receive for hosted phishing pages on our servers.<br /> <br /> I decided to fight this with a bit of AI. The idea was to train an Word2vec and an SVM models to detect if a newly hosted hostname is possibly registered for phishing.<br /> <br /> We manualy selected 2000 domains that we were sure are phishing related, like the ones below:<br /> ebay.co.uk.aspx.asfdfw.com<br /> amazon.com.store.3b01no.com<br /> <br /> We found around 4000 phishing hostnames with this technique and we are going to deploy it for phishing directories and files.</div>

Sha2017.org-hackman