The following is presented to encourage comments and discussion about a short research project designed to illuminate the existing state and possible efficient methods for the future on this topic.

Proposed project title: Results of Reporting Phishing Activity or - unfortunately for the world, Y.A.Acronym... RoRPA.

Inputs:

People who report phishing activity provide RoRPA with the following info - omitting whatever doesn't apply or is redundant:

URL of phishing website
Full original email sample if applicable
Additional data if available: Registrar, AS of host, IPs involved and NS at the time of the report

For each entity they report the phishing activity to:
Date and time of report
Type of entity (Registrar, NS host, domain owner etc)
Method of reporting (email, web form, phone, skywriting...)
Contact info (the email address, url of web form, phone number, may use a code instead here if the info is confidential)
Contact person if known
Entity

If a phishing site URL is involved:
RoRPA monitors the URL using readily available tools for checking if a certain URL is up and contains certain text. RoRPA records the event when the site goes offline or when the hostname involved (if any) changes IP, route, or NS host.

Any party having information that the phishing site has been taken down enters that event along with the evidence that it is down.

Any party having information about complicity (TBD parameters) of any entity the report goes to, enters the notes about these events.

Monitoring continues to see if similar related sites reappear, using TBD methodology to seek related phishing activity.

Outputs:

Which reporting methods got the sites taken down fastest?

Which entities (registrar, web host, domain owner, other) were able to act to nullify the phishing activity most effectively?

Which entities were most often perceived as complicit with the criminal?

Variables:

Inputs may be non-factual, intentionally or unintentionally.

Results may represent reporters perceptions rather than objective fact.

Comments about complicity may need to be confidential or anon. Anon inputs are less trustable.

Entering any data beyond reports themselves is arduous and may not get done.

What numbers and time period and cross-section of types of reporters will represent a statistically viable sample of phishing reports?


This research project is proposed based on discussion in anti phishing operational group where one issue is who should take sites down, under what conditions, what are the costs of leaving phishing sites up while waiting for response to abuse reports, and how can we guess who in the chain is "innocent".