We also discovered a trend on the Dark Web in which service providers perceive dark web domains as their service brands. We analyzed the text content of 28,928 HTTP Tor hidden services hosting 21 million dark webpages and confirmed 901 phishing domains. We conducted an in-depth measurement study to demystify the prevalent phishing websites on the Dark Web.

Phishers abuse this perplexing authenticity to lure victims however, only a little is known about the prevalence of phishing attacks on the Dark Web. This anonymous nature allows website operators to conceal their identity and thereby leads users to have difficulties in determining the authenticity of websites. At the same time, the Dark Web has been a last resort for people who seek freedom of the press as well as avoid censorship. The Dark Web has been notorious for harboring cybercriminals abusing anonymity. We also discuss the implications of our results for phishing defenses.Īnonymous network services on the World Wide Web have emerged as a new web architecture, called the Dark Web. Our study reveals the key mechanisms for information sharing during phishing, particularly with third-parties.

Third, we set up honey accounts to monitor the post-phishing exploitation activities from attackers. Second, we obtain phishing kits from a subset of phishing sites to analyze how credentials are sent to attackers and third-parties on the server side. The goal is to monitor how the credential information is shared with the phishing server and potentially third-party collectors on the client side.

First, we build a measurement tool to feed fake credentials to live phishing sites. Over 5 months, our measurement covers more than 179,000 phishing URLs (47,000 live phishing sites). In this paper, we perform an empirical measurement on the transmission and sharing of stolen login credentials. While existing works have extensively analyzed phishing websites and their operations, there is still a limited understanding of the information sharing flows throughout the end-to-end phishing process. Phishing has been a big concern due to its active roles in recent data breaches and state-sponsored attacks.

Phishing page maker download