14 DAY TRIAL // Security researchers warn that phishers are increasingly abusing the free PasteHTML.com service in order to create and host phishing pages.
As the name suggest, PasteHTML is a service which allows users to easily create plain HTML pages and share them with others.
Users only need to paste the HTML content in a text box and they get back a link to the generated page. This is a very good opportunity for phishers who only need simple HTML pages to trick trick users.
"The ultimate dream of a phisher it to be able to set up thousands of phishing sites freely, anonymously, and quickly. Luckily for them, PasteHtml.com offers a service which empowers them to do just that," Julien Sobrier, senior security researcher at Zscaler, notes.
The abuse of free services is not new. Free file hosting sites have been used to host malware, free domain providers have been used to register domains used in scams, pharma spam images have been hosted on free image sites and so on.
One recent case involved free domain provider CO.TV which was abused in a black hat SEO campaign launched on Google News. Tens, or hundreds or random-looking co.tv domains were registered and used for redirect purposes.
Fortunately, PasteHTML seems to take the abuse seriously and, according to the Zscaler researcher, suspends phishing pages reported to the rather quickly.
A quick response is very important in such cases because studies have shown that when it comes to phishing, the first hour is the most critical one. Half of victims expose their credentials within the first hour, 80% of them in the first eight hours and 90% within ten hours.
PasteHTML seems to take a good approach when dealing with phishing too. It doesn't simply suspend by the pages, but posts a warning that it was fraudulent and asks users not to trust it. This might give users an indication that what they click on was an attack and could spread the word about it. Unfortunately, PasteHTML remains convenient enough for scammers to abuse it.