{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,7,28]],"date-time":"2024-07-28T23:58:38Z","timestamp":1722211118587},"reference-count":43,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2021,2,1]],"date-time":"2021-02-01T00:00:00Z","timestamp":1612137600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"}],"funder":[{"DOI":"10.13039\/100015146","name":"Canadian Internet Registration Authority","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100015146","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000038","name":"Natural Sciences and Engineering Research Council of Canada","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100000038","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computers & Security"],"published-print":{"date-parts":[[2021,2]]},"DOI":"10.1016\/j.cose.2020.102114","type":"journal-article","created":{"date-parts":[[2020,11,14]],"date-time":"2020-11-14T07:37:40Z","timestamp":1605339460000},"page":"102114","update-policy":"http:\/\/dx.doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":10,"special_numbering":"C","title":["On cloaking behaviors of malicious websites"],"prefix":"10.1016","volume":"101","author":[{"given":"Nayanamana","family":"Samarasinghe","sequence":"first","affiliation":[]},{"given":"Mohammad","family":"Mannan","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"key":"10.1016\/j.cose.2020.102114_bib0001","unstructured":"CaliSecurity, Dog. https:\/\/medium.com\/cali-dog-security\/introducing-certstream-3fc13bb98067."},{"key":"10.1016\/j.cose.2020.102114_bib0002","series-title":"ACM Symposium on Theory of Computing (STOC\u201902). Montreal, QC, Canada","article-title":"Similarity estimation techniques from rounding algorithms","author":"Charikar","year":"2002"},{"key":"10.1016\/j.cose.2020.102114_bib0003","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.eswa.2018.03.050","article-title":"A survey of phishing attacks: their types, vectors and technical approaches","volume":"106","author":"Chiew","year":"2018","journal-title":"Expert Syst. Appl."},{"key":"10.1016\/j.cose.2020.102114_bib0004","unstructured":"DNSTwist, 2020. Dnstwist. Online article. https:\/\/github.com\/elceef\/dnstwist."},{"key":"10.1016\/j.cose.2020.102114_bib0005","unstructured":"Domains by Proxy, 2019. Your identity is nobody\u2019s business but ours. Online article. https:\/\/www.domainsbyproxy.com\/."},{"key":"10.1016\/j.cose.2020.102114_bib0006","series-title":"ACM Conference on Computer and Communications Security (CCS\u201915). Denver, Colorado, USA","article-title":"A search engine backed by internet-wide scanning","author":"Durumeric","year":"2015"},{"key":"10.1016\/j.cose.2020.102114_bib0007","unstructured":"Google, 2020. Webmaster guidelines. Online article. https:\/\/support.google.com\/webmasters\/answer\/35769."},{"key":"10.1016\/j.cose.2020.102114_bib0008","unstructured":"Google Chrome, 2019. Puppeteer. Online article. https:\/\/github.com\/GoogleChrome\/puppeteer."},{"key":"10.1016\/j.cose.2020.102114_bib0009","unstructured":"Google Safe Browsing, 2020. Google Safe Browsing. Online article. https:\/\/safebrowsing.google.com\/."},{"key":"10.1016\/j.cose.2020.102114_bib0010","unstructured":"Hudak, P., 2019. Finding phishing: Tools and techniques. Online article. https:\/\/0xpatrik.com\/phishing-domains\/."},{"key":"10.1016\/j.cose.2020.102114_bib0011","unstructured":"Intoli, 2018. It is *not* possible to detect and block Chrome headless. Online article. https:\/\/intoli.com\/blog\/not-possible-to-block-chrome-headless\/."},{"key":"10.1016\/j.cose.2020.102114_bib0012","series-title":"IEEE Symposium on Security and Privacy (SP\u201916). San Jose, CA, USA","article-title":"Cloak of visibility: detecting when machines browse a different web","author":"Invernizzi","year":"2016"},{"key":"10.1016\/j.cose.2020.102114_bib0013","series-title":"ACM Conference on Computer and Communications Security (CCS\u201917), Dallas, TX, USA","article-title":"Hiding in plain sight: a longitudinal study of combosquatting abuse","author":"Kintis","year":"2017"},{"key":"10.1016\/j.cose.2020.102114_bib0014","series-title":"International Symposium on Research in Attacks, Intrusions, and Defenses (RAID\u201916). Evry, France","article-title":"Enabling network security through active DNS datasets","author":"Kountouras","year":"2016"},{"key":"10.1016\/j.cose.2020.102114_bib0015","series-title":"Network and Distributed System Security Symposium (NDSS\u201919). San Diego, CA, USA","article-title":"Tranco: a research-oriented top sites ranking hardened against manipulation","author":"Le Pochat","year":"2019"},{"key":"10.1016\/j.cose.2020.102114_bib0028","unstructured":"Li, S. 2018. Towards data science, https:\/\/towardsdatascience.com\/topic-modeling-and-latent-dirichlet-allocation-in-python-9bf156893c24."},{"issue":"10","key":"10.1016\/j.cose.2020.102114_bib0016","doi-asserted-by":"crossref","first-page":"1717","DOI":"10.1109\/TC.2017.2703808","article-title":"Off-the-hook: an efficient and usable client-side phishing prevention application","volume":"66","author":"Marchal","year":"2017","journal-title":"IEEE Trans. Comput."},{"key":"10.1016\/j.cose.2020.102114_bib0017","unstructured":"Michael Carter, 2010. pywhois. Online article. https:\/\/pypi.python.org\/pypi\/pywhois\/0.1."},{"key":"10.1016\/j.cose.2020.102114_bib0018","series-title":"IEEE Symposium on Security and Privacy (SP\u201919). San Francisco, CA, USA","article-title":"PhishFarm: a scalable framework for measuring the effectiveness of evasion techniques against browser phishing blacklists","author":"Oest","year":"2019"},{"key":"10.1016\/j.cose.2020.102114_bib0019","series-title":"USENIX Security Symposium (USENIX Security\u201920). Online","article-title":"PhishTime: continuous longitudinal measurement of the effectiveness of anti-phishing blacklists","author":"Oest","year":"2020"},{"key":"10.1016\/j.cose.2020.102114_bib0020","series-title":"USENIX Security Symposium (USENIX Security\u201920). Online","article-title":"Sunrise to sunset: analyzing the end-to-end life cycle and effectiveness of phishing attacks at scale","author":"Oest","year":"2020"},{"key":"10.1016\/j.cose.2020.102114_bib0021","series-title":"USENIX Security Symposium (USENIX Security\u201920). Online","article-title":"Towards adversarial phishing detection","author":"Panum","year":"2020"},{"key":"10.1016\/j.cose.2020.102114_bib0023","series-title":"ACM Asia Conference on Computer and Communications Security (AsiaCCS\u201919). Aukland, New Zealand","article-title":"What happens after you leak your password: Understanding credential sharing on phishing sites","author":"Peng","year":"2019"},{"key":"10.1016\/j.cose.2020.102114_bib0024","series-title":"ACM Internet measurement conference (IMC\u201919). Amsterdam, Netherlands","article-title":"Opening the blackbox of VirusTotal: analyzing online phishing scan engines","author":"Peng","year":"2019"},{"key":"10.1016\/j.cose.2020.102114_bib0022","unstructured":"PCrisk, 2019. ERR_NAME_NOT_RESOLVED - How to fix? Online article. https:\/\/blog.pcrisk.com\/windows\/12819-err-name-not-resolved."},{"key":"10.1016\/j.cose.2020.102114_bib0025","unstructured":"Project Sonar, 2020. Forward DNS (FDNS). Online article. https:\/\/opendata.rapid7.com\/sonar.fdns_v2\/."},{"issue":"2","key":"10.1016\/j.cose.2020.102114_bib0026","doi-asserted-by":"crossref","first-page":"813","DOI":"10.1007\/s12652-019-01311-4","article-title":"Catchphish: Detection of phishing websites by inspecting urls","volume":"11","author":"Rao","year":"2020","journal-title":"J. Ambient Intell. Humanized Comput."},{"key":"10.1016\/j.cose.2020.102114_bib0027","unstructured":"RIPE NCC, 2020. RIPE NCC. Online article. https:\/\/www.ripe.net\/."},{"key":"10.1016\/j.cose.2020.102114_bib0030","unstructured":"Selenium, 2019. SeleniumHQ browser automation. Online article. http:\/\/www.seleniumhq.org\/."},{"key":"10.1016\/j.cose.2020.102114_bib0029","unstructured":"ScrapeHero, 2020. https:\/\/www.scrapehero.com\/how-to-prevent-getting-blacklisted-while-scraping\/."},{"key":"10.1016\/j.cose.2020.102114_bib0031","series-title":"Annual Computer Security Applications Conference (ACSAC\u201919). San Juan, Puerto Rico, USA","article-title":"Premadoma: An operational solution for DNS registries to prevent malicious domain registrations","author":"Spooren","year":"2019"},{"key":"10.1016\/j.cose.2020.102114_bib0033","series-title":"ACM Internet Measurement Conference (IMC\u201919). Amsterdam, Netherlands","article-title":"ShamFinder: an automated framework for detecting IDN homographs","author":"Suzuki","year":"2019"},{"key":"10.1016\/j.cose.2020.102114_bib0032","unstructured":"SquatPhish, 2018. Squatting-domain-identification. Online article. https:\/\/github.com\/SquatPhish\/1-Squatting-Domain-Identification."},{"key":"10.1016\/j.cose.2020.102114_bib0034","unstructured":"Symantec, 2020. Webpulse site review request. Online article. https:\/\/sitereview.bluecoat.com\/#\/."},{"key":"10.1016\/j.cose.2020.102114_bib0035","unstructured":"Tesserect, 2019. Tesserect-OCR. Online article. https:\/\/github.com\/tesseract-ocr\/tesseract."},{"key":"10.1016\/j.cose.2020.102114_bib0036","series-title":"ACM Internet Measurement Conference (IMC\u201918).Boston, MA, USA","article-title":"Needle in a haystack: tracking down elite phishing domains in the wild","author":"Tian","year":"2018"},{"key":"10.1016\/j.cose.2020.102114_bib0037","series-title":"ACM Internet Measurement Conference (IMC\u201919). Amsterdam, Netherlands","article-title":"What you see is not what you get: discovering and tracking social engineering attack campaigns","author":"Vadrevu","year":"2019"},{"key":"10.1016\/j.cose.2020.102114_bib0038","series-title":"ACM Internet measurement conference (IMC\u201920). Online","article-title":"Mis-shapes, mistakes, misfits: an analysis of domain classification services","author":"Vallina","year":"2020"},{"key":"10.1016\/j.cose.2020.102114_bib0039","unstructured":"VirusTotal, 2019. VirusTotal. Online article. https:\/\/www.virustotal.com\/gui\/home\/upload."},{"key":"10.1016\/j.cose.2020.102114_bib0040","series-title":"ACM Conference on Computer and Communications Security (CCS\u201911). Chicago, Illinois, USA","article-title":"Cloak and dagger: dynamics of web search cloaking","author":"Wang","year":"2011"},{"key":"10.1016\/j.cose.2020.102114_bib0041","series-title":"International World Wide Web Conference (WWW\u201906). Edinburgh, Scotland, UK","article-title":"Detecting semantic cloaking on the web","author":"Wu","year":"2006"},{"key":"10.1016\/j.cose.2020.102114_bib0042","series-title":"IEEE International Conference on Communications (ICC\u201919). Shanghai, China","article-title":"A comprehensive measurement study of domain-squatting abuse","author":"Zeng","year":"2019"},{"key":"10.1016\/j.cose.2020.102114_bib0043","series-title":"International Conference on Information and Communications Security (ICICS\u201919). Beijing, China","article-title":"Tear off your disguise: phishing website detection using visual and network identities","author":"Zhou","year":"2019"}],"container-title":["Computers & Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404820303874?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404820303874?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2022,11,16]],"date-time":"2022-11-16T09:35:19Z","timestamp":1668591319000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167404820303874"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,2]]},"references-count":43,"alternative-id":["S0167404820303874"],"URL":"https:\/\/doi.org\/10.1016\/j.cose.2020.102114","relation":{},"ISSN":["0167-4048"],"issn-type":[{"value":"0167-4048","type":"print"}],"subject":[],"published":{"date-parts":[[2021,2]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"On cloaking behaviors of malicious websites","name":"articletitle","label":"Article Title"},{"value":"Computers & Security","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.cose.2020.102114","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2020 Elsevier Ltd. All rights reserved.","name":"copyright","label":"Copyright"}],"article-number":"102114"}}