PhishLumos: Exposing phishing campaigns that evade detection by hiding content

PhishLumos, a system developed by researchers at Tokyo Metropolitan University, detects phishing campaigns by pivoting from page content to URL infrastructure (IP resolutions, shared network connections, SSL certificates, and historical scans) to reconstruct campaign graphs and generate detection rules; in tests on real-world campaigns it achieved high coverage and an average lead time of ~8 days with low false positives, but it is limited when attackers use throwaway infrastructure or when external data sources are incomplete, and is intended as an analyst-facing triage tool to complement existing defenses.