{"id":36399,"date":"2020-08-01T15:14:37","date_gmt":"2020-08-01T15:14:37","guid":{"rendered":"http:\/\/5a23397f-f909-43af-a601-2f94b864c0ba"},"modified":"2020-08-01T15:14:37","modified_gmt":"2020-08-01T15:14:37","slug":"phishing-campaigns-from-first-to-last-victim-take-21h-on-average","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/phishing-campaigns-from-first-to-last-victim-take-21h-on-average\/","title":{"rendered":"Phishing campaigns, from first to last victim, take 21h on average"},"content":{"rendered":"
\"istock-9162001221.jpg\"<\/span>
<\/span> Getty Images\/iStockphoto <\/span><\/figcaption><\/figure>\n

A mixed team of security researchers from Google, PayPal, Samsung, and Arizona State University has spent an entire year analyzing the phishing landscape and how users interact with phishing pages.<\/p>\n

In a mammoth project that involved analyzing 22,553,707 user visits to 404,628 phishing pages, the research team has been able to gather some of the deepest insights into how phishing campaigns work.<\/p>\n

“We find that the average phishing attack spans 21 hours between the first and last victim visit, and that the detection of each attack by anti-phishing entities occurs on average nine hours after the first victim visit,” the research team wrote in a report they are scheduled to present at the USENIX security conference this month.<\/p>\n

“Once detected, a further seven hours elapse prior to peak mitigation by browser-based warnings.”<\/p>\n

The research team calls this interval between the start of the campaign and the deployment of phishing warnings inside browsers the “golden hours” of a phishing attack — when attackers make most of their victims.<\/p>\n

But the research team says that once the golden hours end, the attacks continue to make victims, even after browser warnings are deployed via systems like Google’s Safe Browsing API.<\/p>\n

“Alarmingly, 37.73% of all victim traffic within our dataset took place after attack detection,” researchers said.<\/p>\n

\"phishing-histogram.png\"<\/span>