Hiroki Nakano

Phishing campaigns increasingly evade automated scanners through cloaking and selective blocking, which prevents page retrieval and forces URL-by-URL triage. We present PhishLumos, a campaign-level mitigation system that starts from a single seed URL and treats evasion as a pivot signal. When content is missing, deceptive, or inaccessible, PhishLumos pivots to infrastructure evidence, including shared domains, IP addresses, certificates, and historical scan metadata. It consolidates observations into a typed property graph knowledge base with a deterministic, idempotent merge operator and provenance for auditable investigations. A supervisor agent coordinates specialized agents and synthesis agents powered by large language models to profile campaigns and generate empirically validated detection rules for deployment in existing controls. On 103 real-world campaigns (6,020 URLs), PhishLumos achieved a median campaign coverage of 100% and a median detection lead time of 192.8 hours (8.0 days) before expert verification, with a 0.1% false positive rate on 1,000 benign URLs. In a six-month in-the-wild study starting from 600 challenging seed URLs, the generated rules uncovered 192,407 additional URLs; 92.0% were later flagged as malicious by at least one engine in a multi-engine scanning service. Quantitative comparisons against four baselines, including a state-of-the-art LLM-based content classifier, show that under content inaccessibility any content-conditional method (LLM or otherwise) is bounded at 0.341 recall, whereas PhishLumos reaches 0.994 F1 by pivoting to infrastructure evidence.

Phishing attackers widely deploy cloaking techniques that serve phishing content only to targeted victims while presenting benign pages to security scanners, causing even advanced detectors to fail.We present PhishParrot, a retrieval-augmented crawling system that bypasses cloaking by inferring a victim-like access profile for each suspicious URL. PhishParrot performs a preliminary crawl to extract domain, network, and HTML features; retrieves semantically similar successful and failed crawl cases from a continuously growing database; prompts a Large Language Model (LLM) to synthesize an optimal user profile (HTTP headers, geolocation, and network type) from contrastive evidence; and re-crawls the URL under the inferred profile. We evaluate PhishParrot during a nine-month online deployment (May 2025–January 2026) on 163,586 labeled URLs; of the 66,994 phishing URLs, 40% exhibit cloaking. PhishParrot achieves a de-cloaking success rate of 90.8%, improving by 59.2 percentage points over typical user system and 82.1 percentage points over a standard analysis system. Across five downstream phishing detectors, macro-averaged F1 improves from 55.9% (typical user system) to 77.5%, with true-positive rate gains of 29–43 percentage points on cloaked URLs. Weekly de-cloaking performance remains stable throughout deployment (standard deviation 2.7 percentage points), demonstrating that retrieval-augmented, profile-driven crawling provides a practical and sustainable content-acquisition layer for phishing triage under cloaking.

Domain squatting, the malicious registration of deceptive domain names, poses a significant threat to Internet security. This study presents an enhanced version of DomainLynx, a system leveraging Large Language Models (LLMs) for detecting domain squatting. We introduce novel techniques that combine LLMs with domain-specific knowledge to identify a wide range of squatting tactics, including complex hybrid methods that merge multiple deception techniques. Our improved system features refined detection algorithms and an advanced validation process that significantly reduces false positives while maintaining high accuracy. Comprehensive evaluations using various LLM configurations demonstrate DomainLynx’s superior performance. Using a state-of-the-art LLM, the system achieved 94.7% accuracy on a diverse dataset of 1,649 squatting domains. In a month-long real-world test, DomainLynx detected 34,359 potential squatting domains from 2.09 million new registrations, outperforming existing methods by 2.5 times. Further analysis confirmed the system’s effectiveness across different squatting types. We also present case studies of hybrid-squatting domains, such as those combining typos with brand impersonation, offering insights into emerging threats. This research advances Internet security by providing a more accurate, adaptable, and thoroughly evaluated LLM-based tool for combating evolving domain squatting threats, contributing to safer online environments for users and organizations worldwide.

Allow lists are crucial in cybersecurity for distinguishing safe websites from potential threats. Traditional approaches relying on website popularity often fail to capture trustworthy but less-visited domains, leading to increased false positives and overlooked niche websites. This paper presents DomainHarvester, an innovative bottom-up system that leverages the web’s hyperlink structure and a Transformer-based machine learning approach to systematically identify and include these underrepresented yet legitimate domains. Results demonstrate how DomainHarvester dynamically curates an expanded allow list (DHList), substantially reducing the risk of false positives while retaining high precision in excluding malicious sites. Comprehensive evaluations and a real-world case study with a managed security services provider illustrate the efficacy and practicality of this approach. By integrating DomainHarvester, organizations and researchers can benefit from a more inclusive and globally representative cybersecurity allow list, addressing limitations in existing top-list-based solutions.

Large Language Models (LLMs), such as ChatGPT, are significantly impacting various fields. While LLMs have been extensively studied for code generation and text synthesis, their application in detecting malicious web content, particularly phishing sites, remains largely unexplored. To counter the increasing cyber attacks that leverage LLMs for creating more sophisticated and convincing phishing content, it is crucial to automate detection by harnessing LLMs’ advanced capabilities. This paper introduces ChatPhishDetector, a novel system that employs LLMs to identify phishing sites. Our approach involves using a web crawler to collect website information, generating prompts for LLMs based on the gathered data, and extracting detection results from LLM responses. This system enables accurate detection of multilingual phishing sites by identifying impersonated brands and social engineering techniques within the entire website context, without requiring machine learning model training. We evaluated our system’s performance using our own dataset and compared it with baseline systems and several LLMs. Experiments using GPT-4V showed exceptional results, achieving 98.7% precision and 99.6% recall, surpassing the detection performance of other LLMs and existing systems. These findings highlight the potential of LLMs for protecting users from online fraudulent activities and provide crucial insights for strengthening defenses against phishing attacks.

Domain squatting is a technique used by attackers to create domain names for phishing sites. In recent phishing attempts, we have observed many domain names that use multiple techniques to evade existing methods for domain squatting. These domain names, which we call generated squatting domains (GSDs), are quite different in appearance from legitimate domain names and do not contain brand names, making them difficult to associate with phishing. In this paper, we propose a system called PhishReplicant that detects GSDs by focusing on the linguistic similarity of domain names. We analyzed newly registered and observed domain names extracted from certificate transparency logs, passive DNS, and DNS zone files. We detected 3,498 domain names acquired by attackers in a four-week experiment, of which 2,821 were used for phishing sites within a month of detection. We also confirmed that our proposed system outperformed existing systems in both detection accuracy and number of domain names detected. As an in-depth analysis, we examined 205k GSDs collected over 150 days and found that phishing using GSDs was distributed globally. However, attackers intensively targeted brands in specific regions and industries. By analyzing GSDs in real time, we can block phishing sites before or immediately after they appear.