Detection engines

Phishing Shield combines twelve detection engines. Each one detects what the others do not see, and together they cover everything from lookalike domains to attacks that bypass MFA. This page is for whoever administers the extension and wants to know what it detects and why.

The twelve engines

Engine	What it detects
Content cloning detection	Cloned login pages, including perfect copies that bypass URL filters. It analyzes the page structure, DOM elements and visual design
Typosquatting	Domains with swapped letters, such as g00gle.com or mircosoft.com, in real time
Homoglyph detection	Unicode tricks, such as a Cyrillic “a” posing as a Latin “a”
AiTM and reverse proxy	Adversary-in-the-middle kits such as Tycoon2FA, EvilProxy, Sneaky2FA, Evilginx, Modlishka, Caffeine and Greatness. It analyzes headers, timing and resource patterns
ClickFix protection	Clipboard hijacking that tries to get the user to paste and run PowerShell, curl or other commands
Form hijacking	Forms that secretly send credentials to an attacker’s server
QR phishing	QR codes that lead to credential-theft pages (quishing)
VNC attack detection	Screen-sharing attacks in which the attacker watches you type, using noVNC and WebSocket signatures
Session hijacking protection	Token theft even after a safe sign-in, watching browser cookies and storage
MFA bypass detection	Two-factor codes intercepted in transit through AiTM token relay
Threat intelligence	Cross-checking against a database of more than one million trusted domains, curated lists of phishing URLs and more than 18,000 known malicious IP addresses, continuously updated
Phishing database	Known phishing sites, using the aggregated PhishTank and OpenPhish lists, before the user sees the page

The extension also detects phishing pages generated in the browser itself from a block of data (blob).

When it analyzes

There are two phases:

1. Before the page loads, using the address: typosquatting, homoglyphs and the phishing and malicious IP databases.
2. Shortly after it loads, using its content: cloning, AiTM, VNC, QR, ClickFix and blobs.

Behavioral engines, such as session hijacking and MFA bypass, also keep watching while the page is open.

A domain that looks like a brand is not blocked for its name alone: in the second phase, the extension confirms whether the page imitates that brand, because it mentions it or copies its icon. Strong signals, such as a homoglyph or an address listed in the phishing or malicious IP databases, block even if the page never finishes loading.

When it blocks and when it warns

The extension combines the result of all engines for each page:

Result	What happens
Any engine with high risk	Blocks the page and shows the warning
Two or more engines with medium risk	Blocks the page
One engine with medium risk	Shows a notification and does not block
One engine with low risk	Only logs it

It detects the implementation, not the mention

Text-based engines require real technical evidence, not isolated keywords. For example, ClickFix and VNC only trigger on executable code in the page, not on an article describing the attack. That way a page that explains an attack is not blocked.

Brands with advanced detection

Cloning and typosquatting detection protect the most impersonated brands by default: Microsoft, Google, Apple, Facebook, Amazon, PayPal, LinkedIn, GitHub, Netflix, Twitter, Instagram, Yahoo, Adobe, Dropbox, DHL, Santander, BBVA, CaixaBank, ING and Ironchip. You can add your organization’s domains to protect them too. See Warnings and false positives.

More information

• How it works: the overview for the user.
• Deploy in your organization