An increasing number of phishing websites use web analytics services and have unique tracking IDs in their code, security researchers have found. Whether intentional or accidental, the use of such IDs can help defenders discover phishing pages that are used across large attack campaigns.
Researchers from content delivery network Akamai analyzed a set of 54,261 active phishing pages served from 28,906 unique domains and found that 874 domains had web analytics IDs associated with them. Around 396 IDs were from Google Analytics and 75 were used across multiple websites.
