Researcher Releases Data on 100,000 Phishing Attempts to Teach You How to Not Get Hacked

A security researcher who specializes in tracking government hacking attempts published 25GB of data on 100,000 phishing attacks on Monday.

A phishing attack is a legitimate-seeming but fraudulent email or website that tricks a target into sharing their personal information—like username and password—with a hacker. Phishing is an incredibly common way to hack people and carry out cyberespionage corporations. Phishing is the primary attack vector in 32 percent of all data breaches analyzed by Verizon for its annual data breach and incident response (DBIR) report.

Claudio Guarnieri, who works at Amnesty International and has been tracking targeted attacks against dissidents and activists for almost a decade, published the dataset to help other researchers track hackers, and to help cybersecurity educators use them as real-world examples.

“Because phishing is such a dominant threat for the targeted groups I normally work with, I have been working over the last years on a number of tools and services to mitigate and respond to such attacks,” Guarnieri, who has contributed to Motherboard, wrote in a blog post, where he shared a link to download the dataset via torrent.

Guarnieri explained that the archive contains a database of phishing URLs, their corresponding HMTL data, and screenshots of the phishing page.

In fact, as default defenses against malware and other cyberattacks have improved, phishing has gotten even more prevalent in all kinds of attacks. For example, John Podesta and Colin Powell were hacked as part of the 2016 Russian disinformation campaign in the United States thanks to carefully crafted phishing messages. Phishing is also routinely used against journalists, activists, and dissidents in countries like Qatar, Venezuela, and Iran.

As the cybersecurity expert The Gruqg once said, “Give a man an 0day and he'll have access for a day, teach a man to phish and he'll have access for life.”

Subscribe to our new cybersecurity podcast, CYBER.