Thank you for the explanation about the DNS Analysis. Some of Phishing website recently using redirect link as before showing the phishing website. For the example, if we visit malicious website, it will not automatically display the phishing website, but it will be redirect a few times and finally end up in the phishing website. The question, is the DNS analysis using digital certificates could determine this type of phishing method? because the website using more than one domain site or certificate before showing the phishing website. Thank you.
Thank you for your question.
In order to analyze phishing sites using the DNS graph method used in this study, the domain must be listed in the CT log and either the domain or its corresponding component domains must be tagged as phishing.
In other words, there's no need to consider whether phishing sites use redirects if they meet the criteria.
On the other hand, if they don't meet these criteria, they are excluded from the analysis in this study because they are not reflected in the DNS graph.
In my opinion, phishing sites that use redirects are not easily distinguishable in the DNS graph due to their use of multiple unrelated domains.
As a future work, I would like to consider analyzing the redirect links on the DNS graph.
Thank you.
