With a nasty grinding and crunching of over-used metaphors, the shiny new Internet Defence PhishTank has been pushed out of the laboratory, and is now on full display at http://phishery.internetdefence.net.
What is the phishery?
The Phishery is a real time, automated, device to capture and display Phishing Emails. And to keep a tab on what phake logon sites the phishermen are actually using. Phew, that’s got the surpheit of “Ph” out of the way!
The other day, I was reviewing the access logs to www.internetdefence.net, and noticed that we were getting quite a lot of hits from people searching either for a phishing email by reference to the clamav malware name, or by text contained in the email. Now, we do have quite a few references for these, but only casually interspersed through various articles. So it seem to be a Good Thing to create a definitive systematic archive of these. And so the Phishery was born.
Whenever a phishing email is detected, it is placed in the tank. Various useful bits of information a gathered, including a plain text rendering of the content (to aid in searches), plus a rather pretty rendering of the email (thumbnails and full size images):
However, the icing on the cake is that the phishtank also monitors the availability of the fake site - the one that the phishing email directs you to, to harvest the credentials from the victim. I’ve not seen this done before, and I’m hoping that it will yield some interesting information. This can be seen in the real time monitor part of the tank.
For phishing emails that are not recognised by clamav, there is a risk of misidentification. I can’t really quantify that until we have enough data. But an example would be where a Viagra spam is sent out from, say, “alerts@barclays.co.uk”: so an email can have all the hallmarks of a phishing email, but not really be one as such. For these, there is a block on the display of the content, just in case the spam emails contain anything offensive, until they’ve been manually checked.
Anyway, enough on that, the best thing is to head over to the PhishTank, and check it out.
Update: To avoid confusion with what might be another phishing email related project at www.phishtank.com, this site is now called the “phishery” instead of the “phishtank”.