Paper 2026/1501 Original: eprint.iacr.org/2026/1501 ↗

Phishing in the Noise: Analysis of CT-based Phishing Detection Performance on Free Hosting Platforms

Abstract

Free Hosting Platforms (FHPs) let users publish websites with minimal cost and configuration, but the same provider-managed infrastructure can also be used to host phishing websites. We study how this setting affects Certificate Transparency (CT)-based phishing detection by analyzing X.509, CT, and URL features across FHP phishing, FHP benign, non-FHP phishing, and popular benign websites. Reflecting the shared and wildcard certificate practices common in this setting, we analyze the certificate-level and domain-level data separately. Our measurement study shows that many apparent phishing indicators instead reflect hosting-provider characteristics: in our domain-level correlation analysis, hosting-platform status is more strongly associated with the extracted X.509, CT, and URL features than phishing status is, with the strongest FHP-associated feature (subdomain levels, $\eta=0.54$) exceeding the strongest phishing-associated feature (certificate validity period, $\eta=0.31$). We further evaluate two representative CT-based phishing detection frameworks on FHP-only data and discover that provider-managed infrastructure creates challenges for applying them directly. These findings show the need for future work on CT-based phishing detection methods that account for this deployment setting, especially as AI tools lower the effort required to create convincing phishing websites at scale.