Phishing site identification and security remedy
Embodiments are related to determining if an unverified web page is a phishing site of a verified web page. In one or more embodiments, a computing server detects a style sheet element of an unverified web page accessed by a user using a web browser extension. The computing server checks if the detected style sheet element contains a copy of a part of a style sheet element present in the verified web page. If the style sheet element of the unverified web page contains a copy of the part of a style sheet element of the verified web page, indicating that the unverified web page is a phishing site, the computing server takes a security action. In some embodiments, the computing server may check if the unverified web page is a known web page.
1 . A computer-implemented method of determining if a web page is a phishing site comprising:
detecting, with a browser extension, a style sheet element of an unverified web page, wherein the unverified web page is a web page accessed by a user;
checking if the style sheet element of the unverified web page contains a copy of a part of a style sheet element of a verified web page, the verified web page being a trusted web page that is trusted by the browser extension, wherein the part of the style sheet element of the unverified web page is an identifier in the style sheet element that is invisible in a rendered website but is present also in style sheet elements of the verified web page, wherein the identifier is an anti-phishing identifier that is included to the verified web page to detect any unverified web page copying the style sheet element of the verified web page; and
responsive to the style sheet element of the unverified web page containing a copy of the part of the style sheet element of the verified web page, taking a security action that includes issuing a notification through the browser extension to the user that the unverified web page is potentially a phishing website.
2 . The method of claim 1 , wherein a web address of the unverified web page includes part of a string of a web address of the verified web page.
3 . The method of claim 1 , wherein detecting a style sheet element of an unverified web page comprises continuous detecting the style sheet element with a browser extension.
4 . The method of claim 1 , further comprising checking if the unverified web page is a known phishing site.
5 . The method of claim 4 , wherein checking if the unverified web page is a known phishing site comprises comparing the web page to a set of denylisted web pages.
6 . The method of claim 1 , wherein checking if the style sheet element of the unverified web page contains a copy of a part of a style sheet element of a verified web page comprises applying a matching technique to the style sheet element of the unverified web page, wherein the matching technique is one of a regular expression, a direct string comparison, or a cryptographic hash comparison.
7 . The method of claim 1 , further comprising, responsive to the style sheet element of the unverified web page containing a copy of the part of the style sheet element of the verified web page, storing a web address of the unverified web page to be manually verified.
8 . The method of claim 1 , wherein taking a security action comprises notifying the user that the unverified web page is a phishing site, flagging the user as high risk, stopping transactions from an account associated with the user, reporting the unverified web page to a trusted third party, or storing information associated with the unverified web page to be manually verified.
9 . A non-transitory computer-readable storage medium configured to store computer code comprising instructions, wherein the instructions, when executed by one or more processors, cause the one or more processors to:
detect, with a browser extension, a style sheet element of an unverified web page, wherein the unverified web page is a web page accessed by a user;
check if the style sheet element of the unverified web page contains a copy of a part of a style sheet element of a verified web page, the verified web page being a trusted web page that is trusted by the browser extension, wherein the part of the style sheet element of the unverified web page is an identifier in the style sheet element that is invisible in a rendered website but is present also in style sheet elements of the verified web page, wherein the identifier is an anti-phishing identifier that is included to the verified web page to detect any unverified web page copying the style sheet element of the verified web page; and
responsive to the style sheet element of the unverified web page containing a copy of the part of the style sheet element of the verified web page, take a security action that includes issuing a notification through the browser extension to the user that the unverified web page is potentially a phishing website.
10 . The non-transitory computer-readable storage medium of claim 9 , wherein a web address of the unverified web page includes part of a string of a web address of the verified web page.
11 . The non-transitory computer-readable storage medium of claim 9 , wherein the instruction for detecting a style sheet element of an unverified web page comprises instructions that, when executed by the one or more processors, cause the one or more processors to continuously detect the style sheet element with a browser extension.
12 . The non-transitory computer-readable storage medium of claim 9 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to check if the unverified web page is a known phishing site.
13 . The non-transitory computer-readable storage medium of claim 12 , wherein the instruction for checking if the unverified web page is a known phishing site comprises instructions that, when executed by the one or more processors, cause the one or more processors to compare the web page to a set of denylisted web pages.
14 . The non-transitory computer-readable storage medium of claim 9 , wherein the instruction for checking if the style sheet element of the unverified web page contains a copy of a part of a style sheet element of a verified web page comprises instructions that, when executed by the one or more processors, cause the one or more processors to apply a regular expression to the style sheet element of the unverified web page.
15 . The non-transitory computer-readable storage medium of claim 9 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to, responsive to the style sheet element of the unverified web page containing a copy of the part of the style sheet element of the verified web page, store a web address of the unverified web page to be manually verified.
16 . The non-transitory computer-readable storage medium of claim 9 , wherein the instruction for taking a security action comprises instructions that, when executed by the one or more processors, cause the one or more processors to notify the user that the unverified web page is a phishing site, flag the user as high risk, stop transactions from an account associated with the user, report the unverified web page to a trusted third party, or store information associated with the unverified web page to be manually verified.
17 . A system, comprising:
one or more processors and memory, the memory configured to store instructions,
wherein the instructions, when executed by the one or more processors, cause the one or more processors to:
detect, with a browser extension, a style sheet element of an unverified web page, wherein the unverified web page is a web page accessed by a user;
check if the style sheet element of the unverified web page contains a copy of a part of a style sheet element of a verified web page, the verified web page being a trusted web page that is trusted by the browser extension, wherein the part of the style sheet element of the unverified web page is an identifier in the style sheet element that is invisible in a rendered website but is present also in style sheet elements of the verified web page, wherein the identifier is an anti-phishing identifier that is included to the verified web page to detect any unverified web page copying the style sheet element of the verified web page; and
responsive to the style sheet element of the unverified web page containing a copy of the part of the style sheet element of the verified web page, take a security action that includes issuing a notification through the browser extension to the user that the unverified web page is potentially a phishing website.
18 . The system of claim 17 , wherein a web address of the unverified web page includes part of a string of a web address of the verified web page.
19 . The system of claim 17 , wherein the instruction for detecting a style sheet element of an unverified web page comprises instructions that, when executed by the one or more processors, cause the one or more processors to continuously detect with a browser extension.
20 . The system of claim 17 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to check if the unverified web page is a known phishing site.