Phishing detection using certificates associated with uniform resource locators

A system comprising:

• a non-transitory memory storing instructions;
• and
• a processor configured to execute the instructions to cause the system to:
• determine issuance of a new certificate for a new uniform resource locator (URL), where the new certificate indicates at least one URL that includes the new URL;
• in response to a determination that the new URL is suspect, access certificate portions of the new certificate;
• assign a certificate rule score based on partial certificate scores of each portion of the certificate, the certificate rule score indicating a phishing potential for the certificate, each of the partial certificate scores indicating a likelihood of phishing of each respective portion based on certificate rules;
• use a machine learning model based, at least in part, on the URL score and the certificate to determine a uniqueness certificate score;
• determine a phishing certificate score based, at least in part, on the certificate rule score and the uniqueness certificate score for the certificate;
• and
• determining a registration score of the certificate, wherein the registration score indicates a probability distribution of characters in the potential phishing URL, wherein the final phishing score is further based on the entropy score for the potential phishing URL.

A non-transitory machine-readable medium having instructions stored thereon, the instructions executable to cause performance of operations comprising:

• determining issuance of a new certificate for a new uniform resource locator (URL), where the new certificate indicates at least one URL that includes the new URL;
• in response to a determination that the new URL is suspect, accessing certificate portions of the new certificate;
• assigning a certificate rule score based on partial certificate scores of each portion of the certificate, the certificate rule score indicating a phishing potential for the certificate, each of the partial certificate scores indicating a likelihood of phishing of each respective portion based on certificate rules;
• using a machine learning model based, at least in part, on the URL score and the certificate to determine a uniqueness certificate score;
• determining a phishing certificate score based, at least in part, on the certificate rule score and the uniqueness certificate score for the certificate;
• and
• determining a registration score of the certificate, wherein the registration score indicates a probability distribution of characters in the potential phishing URL, wherein the final phishing score is further based on the entropy score for the potential phishing URL.