Catching Phishers By Their Bait: Investigating the Dutch Phishing Landscape through Phishing Kit Detection


Hugo Bijmans, Tim Booij, and Anneke Schwedersky, Netherlands Organisation for Applied Scientific Research (TNO); Aria Nedgabat, Eindhoven University of Technology; Rolf van Wegberg, Delft University of Technology


Off-the-shelf, easy-to-deploy phishing kits are believed to lower the threshold for criminal entrepreneurs going phishing. That is, the practice of harvesting user credentials by tricking victims into disclosing these on fraudulent websites. But, how do these kits impact the phishing landscape? And, how often are they used? We leverage the use of TLS certificates by phishers to uncover possible Dutch phishing domains aimed at the financial sector between September 2020 and January 2021. We collect 70 different Dutch phishing kits in the underground economy, and identify 10 distinct kit families. We create unique fingerprints of these kits to measure their prevalence in the wild. With this novel method, we identify 1,363 Dutch phishing domains that deploy these phishing kits, and capture their end-to-end life cycle—from domain registration, kit deployment, to take-down. We find the median uptime of phishing domains to be just 24 hours, indicating that phishers do act fast. Our analysis of the deployed phishing kits reveals that only a small number of different kits are in use. We discover that phishers increase their luring capabilities by using decoy pages to trick victims into disclosing their credentials. In this paper, we paint a comprehensive picture of the tactics, techniques and procedures (TTP) prevalent in the Dutch phishing landscape and present public policy takeaways for anti-phishing initiatives.

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

@inproceedings {274537,
author = {Hugo Bijmans and Tim Booij and Anneke Schwedersky and Aria Nedgabat and Rolf van Wegberg},
title = {Catching Phishers By Their Bait: Investigating the Dutch Phishing Landscape through Phishing Kit Detection},
booktitle = {30th USENIX Security Symposium (USENIX Security 21)},
year = {2021},
isbn = {978-1-939133-24-3},
pages = {3757--3774},
url = {},
publisher = {USENIX Association},
month = aug

Presentation Video