7.1. The Fresh Phish Is in the Tank

Live phishing sites are doorways into the phishing underground. This means that to enter the phishing ecosystem, we must first locate live phishing sites to study how they are designed.

Phishing sites have a Time to Live (a TTL, or the time from when they are launched to the time by which the Internet service providers discover them and shut them down) of just a few hours. This makes it difficult to manually attempt to locate live phishing sites, which is ironic because the thousands of victims who fall prey to them end up finding them with ease, albeit unintentionally.