Phishing site detection device, phishing site detection method and phishing site detection program

A phishing site detection method performed by a phishing site detection device, comprising:

• a step of acquiring a phishing kit that is a tool for constructing a phishing site;
• a step of constructing a phishing site using the acquired phishing kit and reproducing actions of a phishing site;
• a step of extracting, from the phishing kit, a condition of access sources with which an access to the phishing site constructed using the phishing kit is blocked;
• a step of accessing each phishing site constructed by each phishing kit using the extracted condition of access sources, and forming access result information that associates an access result regarding the phishing site and the condition of access sources used for the access to the phishing site;
• and
• a step of selecting a condition of access sources with which the access to the phishing site is blocked on a basis of the access result indicated in the access result information, performing processing of accessing a website that has a possibility of being a phishing site at least once, and determining, if the access to the website is blocked, that the website is a phishing site.

A non-transitory computer-readable recording medium having stored therein phishing site detection program causing a computer to execute a process comprising:

• acquiring a phishing kit that is a tool for constructing a phishing site;
• constructing a phishing site using the acquired phishing kit and reproducing actions of a phishing site;
• extracting, from the phishing kit, a condition of access sources with which an access to the phishing site constructed using the phishing kit is blocked;
• accessing each phishing site constructed by each phishing kit using the extracted condition of access sources, and forming access result information that associates an access result regarding the phishing site and the condition of access sources used for the access to the phishing site;
• and
• selecting a condition of access sources with which the access to the phishing site is blocked on a basis of the access result indicated in the access result information, performing processing of accessing a website that has a possibility of being a phishing site at least once, and determining, if the access to the website is blocked, that the website is a phishing site.