2 ms·

Better format: http://pastebin.com/1NE2Tud8 http://pastebin.com/1NE2Tud8 Can you remove the "core" part of the url? => UrlPathToken=core = 1 You could try ano

by fotcorn 13y ago

Better format: http://pastebin.com/1NE2Tud8 http://pastebin.com/1NE2Tud8 Can you remove the "core" part of the url? => UrlPathToken=core = 1 You could try another file extensions for the page (don't now if this is possible with gwt). => UrlPathToken=html = 1 The "powered by" link seems also problematic => PageLinkDomain=tonido.com = 1

markshepard 13y ago
Interesting! I guess most phishing guys have this on their URL and in their page. Therefore it MUST mean that every page with those keys are phishing... just great. Chrome user$ grep phish chrome_debug.log | grep -e "UrlPath" -e "PageTerm" [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: UrlPathToken=html = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: UrlPathToken=core = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageTerm=password = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageTerm=connexion = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: UrlPathToken=index = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageTerm=account = 1