Attack resistant phishing detection

A phishing detection server component comprising:

• a report store that stores information regarding password reuse event reports employed to perform phishing analysis;
• and
• a report verification component that receives password reuse event reports from a plurality of client components, each report comprising a timestamp,
• the report verification component determining whether one or more of the reports are false, a false report comprising at least one of:
• a report received from a phisher;
• or
• a report with a timestamp associated with a site subsequently identified as a phishing site,
• the report verification component analyzing an aggregation of the reports to ascertain a suspected phishing site and a target.

A computer-implemented method comprising:

• receiving a password reuse event report from a client, the password reuse report comprising information regarding use of a protected credential of the client at a site not corresponding to the protected credential;
• the protected credential having an associated unique token previously provided to the client for the protected credential;
• the password reuse event report received including the token previously provided;
• determining, by a processor, that phishing by a phisher has occurred;
• providing a target site corresponding to the protected credential with user information of a phished user;
• and
• changing credentials associated with the phished user at the target site to allow access by the phished user to a trusted site and limit or deny access by the phisher to the trusted site.