Aleksandr Nahapetyan | Searcharxiv

arXiv2026

Characterizing Phishing Pages by JavaScript Capabilities

Phishers achieve large-scale attacks by using ready-to-deploy phishing websites (phishing kits) to rapidly launch campaigns that leverage specific data exfiltration, evasion, or mimicry techniques. In contrast, researchers and defenders continue to rely on manual analysis to identify features for kit fingerprinting. In this paper, we examine the link between a page's client-side behavior and the underlying phishing kit used, enabling automated aggregation of phishing pages. Our key insight is that client-side techniques make heavy use of browser APIs, which, in turn, differentiate underlying kits based on their feature sets. Using an instrumented browser and a URL fuzzing utility, we collected traces from 1,328,917 pages and recovered kit archives for 4,180 pages between August 2023 and January 2025. For the labeled subset, we find that clustering based on the set of browser APIs executed yields 98% accuracy in grouping them by the underlying kit. We also find that 434,495 phishing pages execute enough browser APIs to cluster into 9,306 clusters, compressing multi-lingual phishing pages across various domains into a single cluster. Our findings show that analysts and researchers can leverage the complexity of client-side phishing code to track phishers' kit deployments in the wild.

cs.CR↗

arXiv2024

Characterizing Robocalls with Multiple Vantage Points

Telephone spam has been among the highest network security concerns for users for many years. In response, industry and government have deployed new technologies and regulations to curb the problem, and academic and industry researchers have provided methods and measurements to characterize robocalls. Have these efforts borne fruit? Are the research characterizations reliable, and have the prevention and deterrence mechanisms succeeded? In this paper, we address these questions through analysis of data from several independently-operated vantage points, ranging from industry and academic voice honeypots to public enforcement and consumer complaints, some with over 5 years of historic data. We first describe how we address the non-trivial methodological challenges of comparing disparate data sources, including comparing audio and transcripts from about 3 million voice calls. We also detail the substantial coherency of these diverse perspectives, which dramatically strengthens the evidence for the conclusions we draw about robocall characterization and mitigation while highlighting advantages of each approach. Among our many findings, we find that unsolicited calls are in slow decline, though complaints and call volumes remain high. We also find that robocallers have managed to adapt to STIR/SHAKEN, a mandatory call authentication scheme. In total, our findings highlight the most promising directions for future efforts to characterize and stop telephone spam.

cs.CR↗