Previous Research

See the Papers page for previously published research relating to phishing websites and other topics.

Internet Phishing Websites

Intelligence and Security Informatics Data Sets

AZSecure-data.org

Data Infrastructure Building Blocks for ISI. A Project of the University of Arizona (NSF #ACI-1443019), Drexel University,

University of Virginia, University of Texas at Dallas, and University of Utah

These phishing websites were collected by the University of Virginia. They are presented here by type of organization. Click on the link for the organization type of interest to download the compressed files:

ESCROW

Concocted Escrow Files: Contains 334 concocted Escrow, Bank, Transportation, and Delivery websites. URLs came from Escrow Fraud Prevention at http://escrow-fraud.com / and Artists Against 4-1-9 at http://wiki.aa419.org/index.php/Main_Page.

readme.txt

ConcoctedEscrow.zip (129 MB zipped, 276 MB unzipped)

FINANCIAL

Spoof Financial Files: Contains 389 spoof financial websites (e.g., banks, PayPal, eBay, etc.). URLs came from PhishTank at http://www.phishtank.com/ These were mostly used in phishing email-based attacks. Warning – for each site, all files on the server were collected (text, images, code, etc.). Some folders may contain malware. Please review the DIBBs-ISI Malware Handling Protocol.

readme.txt

SpoofFinancial.zip (159 MB zipped, 402 MB unzipped)

Legitimate Financial Files: Contains 50 legitimate financial websites (e.g., banks, PayPal, eBay, escrow sites, etc.). Can be paired up with the Financial Spoof or Concocted Escrow websites for classification tasks.

readme.txt

LegitFinancial.zip (180 MB zipped, 570 MB unzipped )

PHARMACY

Concocted Pharmacy Websites: Contains 150 concocted pharmacies that used black hat SEO (i.e., link spam) to reach the top 100 in search engine rankings. URLs were verified thru LegitScript at http://www.legitscript.com/.

readme.txt

ConcoctedPharma.zip (1.4 GB zipped, 8.1 GB unzipped )

Legitimate Pharmacy Websites: Contains 150 legitimate pharmacies. Legitimacy was verified through the National Association of Boards of Pharmacies (NABP) and LegitScript at http://www.legitscript.com/.

readme.txt

LegitPharma.zip (659 MB zipped, 2.6 GB unzipped)

Pharmacy Extracts: Contains text and URL extracts from the aforementioned 150 concocted and 150 legitimate pharmacies (derived using HTML parsing tools). The text and URL extract files are site-level, with all text for a given website appearing in a single row.

readme.txt

PharmaExtracts.zip (107 MB zipped, 860 MB unzipped)

TARGETED BRANDS

Phishing-Targeted Brands – Contains time series data from 2006 through 2015 for 178 prominent targeted brands, with URL and Whois information for each phishing attack. The data includes nearly 1.5 million attack URLs.

readme.txt
TargetedBrands.zip (86.5 MB zipped, 1.6 GB unzipped))

PHISHMONGER

PhishMonger - Contains ~393,000 phishing websites collected between November 2015 and May 2018. Each output series represents one month of collection. This research is ongoing and more websites will be added to this portal as the researchers make them available to the public. CAUTION: THIS DATASET MAY CONTAIN MALWARE. Please review the DIBBs-ISI Malware Handling Protocol. The phishmonger tool is maintained at https://github.com/mcintirecba/phishmonger.

readme-PhishMonger.txt

readme2.txt

PhishMonger_Dobolyi_Abbasi_ISI-2016_preprint.pdf

IEEE_ISI_2016_Poster.pdf

IEEE_ISI_2016_Presentation_Short.pdf

Due to file size, some outputs were separated into multiple parts. Download all parts into one folder and open the first file (001) to recombine.

INDEX FILES 1-21113

index.zip (69 GB zipped)

OUTPUT 1-28

output_1-28.zip.001   (10.2 GB zipped)
output_1-28.zip.002   (10.2 GB zipped)
output_1-28.zip.003   (10.2 GB zipped)
output_1-28.zip.004   (10.2 GB zipped)
output_1-28.zip.005   (10.2 GB zipped)
output_1-28.zip.006   (10.2 GB zipped)
output_1-28.zip.007   (10.2 GB zipped)
output_1-28.zip.008   (10.2 GB zipped)
output_1-28.zip.009   (1.1 GB zipped)