Gollum: One anti-phish bot to rule them all
summary
Gollum automates detection, classification, confirmation, reporting and tracking of credential phishing using referrer logs, anti‑phishing feeds and a user‑reported mailbox; it runs on AWS EC2 (Python/Django), delegates internet scraping to Shelob, screenshots pages in a headless browser and classifies brands via TensorFlow transfer learning. Reported sites go to PhishTank and vendor feeds; Google Safe Browsing picks up ~95% within ~30 minutes. Deployed in production at a large South African bank; stats: 2.3% Gmail reports, 32% of phish use SSL.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:22Overview
- 2:45Methodology
- 6:39Detection via referrer log
- 9:31Classify email
- 10:49A word on A
- 12:54Classify referrer
- 14:58Reporting phish
- 15:56Tracking phish
- 17:30Architecture
- 20:12Terraform
- 21:41Demo
- 33:29Statistics
- 35:42Future work
- 37:29Open Sourcing
related talks
09mBridging the Gap: Developing Accessible Anti-Phishing Solutions
54mDark Fairytales From A Phisherman
58mCatching Transparent Phish: Understanding and Detecting MITM Phishing Kits
29mHook, Line, and Tinker: A Dive into Phishing Campaign Sites
51mDeepPhish: Simulating Malicious AI
30mBuilding a Predictive Pipeline to Rapidly Detect Phishing Domains
31mAI-Powered Solutions for Cybersecurity
41mRed Phish, Blue Phish: Improved Phishing Detection Using Perceptual Hashing