Abstract: Aspects of the present invention disclose a method, computer program product, and system for updating a whitelist. The method includes one or more processors identifying candidates for a whitelist based on correlations between candidates and web domains in the whitelist. The method further includes one or more processors extracting textual information and image information from the whitelist candidates. The method further includes one or more processors classifying the candidates for the whitelist into groups of candidates based on a comparison of the extracted information from the whitelist candidates and information associated with the web domains existing in the whitelist. The method further includes one or more processors determining candidates to add to the whitelist based upon a similarity measure ranking between the web domains existing in the whitelist and the candidates for a whitelist. The method further includes one or more processors updating the whitelist to include the determined candidates.

Abstract: A method, computer system, and a computer program product for identifying a phishing attack is provided. The present invention may include receiving an alert of a suspicious URL. The present invention may include making an HTTP request to the suspicious URL. The present invention may include downloading and rendering the suspicious URL content. The present invention may include producing a screenshot of the rendered suspicious URL content. The present invention may include making an HTTP request to a domain landing page. The present invention may include downloading and rendering the domain landing page URL content. The present invention may include producing a screenshot of the rendered domain landing page URL content. The present invention may include generating a score based on comparing the produced first screenshot and the produced second screenshot.

Abstract: A method, computer system, and a computer program product for identifying a phishing attack is provided. The present invention may include receiving an alert of a suspicious URL. The present invention may include making an HTTP request to the suspicious URL. The present invention may include downloading and rendering the suspicious URL content. The present invention may include producing a screenshot of the rendered suspicious URL content. The present invention may include making an HTTP request to a domain landing page. The present invention may include downloading and rendering the domain landing page URL content. The present invention may include producing a screenshot of the rendered domain landing page URL content. The present invention may include generating a score based on comparing the produced first screenshot and the produced second screenshot.

Abstract: Aspects of the present invention disclose a method, computer program product, and system for updating a whitelist. The method includes one or more processors identifying candidates for a whitelist based on correlations between candidates and web domains in the whitelist. The method further includes one or more processors extracting textual information and image information from the whitelist candidates. The method further includes one or more processors classifying the candidates for the whitelist into groups of candidates based on a comparison of the extracted information from the whitelist candidates and information associated with the web domains existing in the whitelist. The method further includes one or more processors determining candidates to add to the whitelist based upon a similarity measure ranking between the web domains existing in the whitelist and the candidates for a whitelist. The method further includes one or more processors updating the whitelist to include the determined candidates.