Artifact - Doubly Dangerous: Evading Phishing Reporting Systems by Leveraging Email Tracking Techniques

This repository contains the artifact for our paper "Doubly Dangerous: Evading Phishing Reporting Systems by Leveraging Email Tracking Techniques". In keeping with open science guidelines, we are making all artifacts available for researchers.Note that this is a private repository that contain artifacts that can potentially be misused like IP Addresses, Autonomous System names of crawlers used by email providers, etc. Therefore, we are restricting the access to only security researchers to prevent potential abuse. If you need access to the public repository instead, please refer to: https://doi.org/10.5281/zenodo.15612284 The artifact can be unzipped to get the folder structure as a follows, encompassing four key components: email-sending: A laravel web application for crafting and sending emails embedded with HTML/CSS tracking vectors. For more detail, see email-sending/README.md. websites-code: A laravel web application that serves as the landing page for URLs in the emails, containing the ability while to decide whether to show a benign page or a phishing page based on incoming signals. Also contains code for honey websites that collect network data like IP, AS name, etc., as well as fingerprinting code for canvas fingerprinting and JS-based font fingerprinting. For more detail, see websites-code/README.md. email-reporting-gui: A collection of Python scripts that automates logging into webmail clients, opening emails, clicking links, and reporting them as phishing to simulate user behavior. Additionally, monitors a reported URL by taking screenshots of the webpage in Chrome and Edge browsers. For more detail, email-reporting-gui/README.md. dataset/data.sql: A full SQL dump of our database, containing the collected data from our experiments. Provides a helper script to query and produce the results of the paper.