  With the advent of online social media, phishers have started using social
networks like Twitter, Facebook, and Foursquare to spread phishing scams.
Twitter is an immensely popular micro-blogging network where people post short
messages of 140 characters called tweets. It has over 100 million active users
who post about 200 million tweets everyday. Phishers have started using Twitter
as a medium to spread phishing because of this vast information dissemination.
Further, it is difficult to detect phishing on Twitter unlike emails because of
the quick spread of phishing links in the network, short size of the content,
and use of URL obfuscation to shorten the URL. Our technique, PhishAri, detects
phishing on Twitter in realtime. We use Twitter specific features along with
URL features to detect whether a tweet posted with a URL is phishing or not.
Some of the Twitter specific features we use are tweet content and its
characteristics like length, hashtags, and mentions. Other Twitter features
used are the characteristics of the Twitter user posting the tweet such as age
of the account, number of tweets, and the follower-followee ratio. These
Twitter specific features coupled with URL based features prove to be a strong
mechanism to detect phishing tweets. We use machine learning classification
techniques and detect phishing tweets with an accuracy of 92.52%. We have
deployed our system for end-users by providing an easy to use Chrome browser
extension which works in realtime and classifies a tweet as phishing or safe.
We show that we are able to detect phishing tweets at zero hour with high
accuracy which is much faster than public blacklists and as well as Twitter's
own defense mechanism to detect malicious content. To the best of our
knowledge, this is the first realtime, comprehensive and usable system to
detect phishing on Twitter.
