Login failure sequence for detecting phishing
A login page of an online service is received in a user computer. False credentials, such as a false user identifier (ID) and a false password, are entered into the login page to login to the online service. The login page is classified as phishing when the online service does not serve a legitimate login-fail page in response to the entry of the false credentials in the login page.
1. A computer-implemented method comprising:
detecting, in a user computer, a login page served by a website;
entering a false credential in the login page;
receiving a login-fail page from the website, wherein the log-in fail page is responsive to the entry of the false credential in the login page;
determining if the login-fail page is legitimate by comparing the login-fail page to a plurality of legitimate login-fail pages; and
in response to determining that the login-fail page is not legitimate, preventing a credential from being entered in a webpage served by the website.
2. The computer-implemented method of claim 1 , wherein the false credential is entered in the login page in the user computer.
3. The computer-implemented method of claim 1 , wherein the false credential is a false user identifier (ID).
4. The computer-implemented method of claim 1 , wherein the false credential is a false password.
5. The computer-implemented method of claim 1 , wherein determining if the login-fail page is legitimate by comparing the login-fail page to the plurality of legitimate login-fail pages comprises:
consulting a database that lists the plurality of legitimate login-fail pages.
6. The computer-implemented method of claim 1 , wherein the false credential is randomly generated.
7. A computer comprising a memory and a processor, the memory including instructions that when executed by the processor cause the computer to:
detect, in the computer, a login page served by a website;
enter a false credential in the login page;
receive a login-fail page from the website, wherein the log-in fail page is responsive to the entry of the false credential in the login page;
determine if the login-fail page is legitimate by comparing the login-fail page to a plurality of legitimate login-fail pages; and
in response to determining that the login-fail page is not legitimate, prevent a credential from being entered in a webpage served by the website.
8. The computer of claim 7 , wherein the false credential is a false user identifier (ID).
9. The computer of claim 7 , wherein the false credential is a false password.
10. The computer of claim 7 , wherein comparing the login-fail page to the plurality of legitimate login-fail pages includes consulting a database that lists the plurality of legitimate login-fail pages.
11. The computer of claim 7 , wherein the false credential is randomly generated.