Artifact - Doubly Dangerous: Evading Phishing Reporting Systems by Leveraging Email Tracking Techniques

This repository contains the artifact for our paper "Doubly Dangerous: Evading Phishing Reporting Systems by Leveraging Email Tracking Techniques". In keeping with open science guidelines, we are making all artifacts available for researchers.Note that this is a private repository that contain artifacts that can potentially be misused like IP Addresses, Autonomous System names of crawlers used by email providers, etc. Therefore, we are restricting the access to only security researchers to prevent potential abuse. If you are looking for to the public repository instead, please refer to: https://doi.org/10.5281/zenodo.15612284 The artifact can be unzipped to get the folder structure as a follows, encompassing four key components: results: This directory provides dataset in a dockerized environment to reproduce the paper's key results using our final dataset. full_database_dump.sql: A complete PostgreSQL dump containing all data collected during our experiments. analysis/queries.py: A Python script that executes queries against the database to generate the tables and figures presented in the paper. docker-compose.yml: A Docker Compose file that automatically sets up a PostgreSQL container and loads the dataset, providing a friction-free environment for running the analysis script. code: This directory contains the source code for the experimental system, which is composed of several Laravel and Python applications. email-sending: A laravel web application for crafting and sending emails embedded with HTML/CSS tracking vectors. For more detail, see email-sending/README.md. websites-code: A laravel web application that serves as the landing page for URLs in the emails, containing the ability while to decide whether to show a benign page or a phishing page based on incoming signals. Also contains code for honey websites that collect network data like IP, AS name, etc., as well as fingerprinting code for canvas fingerprinting and JS-based font fingerprinting. For more detail, see websites-code/README.md. email-reporting-gui: A collection of Python scripts that automates logging into webmail clients, opening emails, clicking links, and reporting them as phishing to simulate user behavior. Additionally, monitors a reported URL by taking screenshots of the webpage in Chrome and Edge browsers. For more detail, email-reporting-gui/README.md. README.md: The main entry point for the artifact, providing the overview of the contents. Additional README files in individual folders will provide more details pertaining to those folders.