SavedAdd your journal

Journals / Niğde Ömer Halisdemir Üniversitesi Mühendislik Bilimleri Dergisi / 2026 / Cilt: 17

Analysis of e-banking phishing via cloned web interfaces: Attack vectors and detection approaches

Klonlanmış web arayüzleri üzerinden elektronik bankacılık oltalama analizi: Saldırı vektörleri ve tespit yaklaşımları

İlker Kara(HACETTEPE UNIVERSITY, HACETTEPE VOCATIONAL SCHOOL)0000-0002-9670-8964
Pages
—
Publication Date
2026-07-13
🏛️Bibliographic metadata and full text access for this article are provided via DergiPark.
DergiPark Record ↗
✨

AI Summary & Key Takeaways

AI Insight
⚡ TL;DR(Too Long; Didn't Read)

The results indicate that phishing campaigns cannot be mitigated solely through user awareness; instead, DNS, content, certificate, and infrastructure indicators should be evaluated together.

📌 3 Key Takeaways

🎯
Objective & Hypothesis:With the widespread adoption of digital banking platforms, phishing-based fraudulent redirection attacks have become one of the most critical cyber threats targeting the financial sector.
📊
Key Findings & Data:Data published by the National Cyber Incident Response Center (USOM) show that malicious URLs in Türkiye have reached hundreds of thousands, indicating the persistence of locally operated phishing campaigns and the increasing diversity of attackers’ techniques.
💡
Conclusion & Impact:The results indicate that phishing campaigns cannot be mitigated solely through user awareness; instead, DNS, content, certificate, and infrastructure indicators should be evaluated together.
🔬Design:Araştırma Makalesi
📍Scope:Comprehensive Sample
⚙️Variables:Dijital bankacılık · oltalama saldırıları · Zararlı bağlantılar

Abstract

With the widespread adoption of digital banking platforms, phishing-based fraudulent redirection attacks have become one of the most critical cyber threats targeting the financial sector. Data published by the National Cyber Incident Response Center (USOM) show that malicious URLs in Türkiye have reached hundreds of thousands, indicating the persistence of locally operated phishing campaigns and the increasing diversity of attackers’ techniques. This study presents a forensic case analysis of a phishing incident targeting e-banking users, focusing on domain manipulation, cloned web interfaces, and reverse-proxy-based session hijacking. The analysis examines domain registration records, hosting infrastructure, certificate attributes, redirection flow, and HTML structure within a structured multi-layered framework. The findings show that attackers rely on short-lived and rapidly changing domain infrastructures to support credential theft and session hijacking attempts. In addition, several indicators of compromise (IoCs) were derived with the support of USOM data to facilitate the early detection of similar attacks. The results indicate that phishing campaigns cannot be mitigated solely through user awareness; instead, DNS, content, certificate, and infrastructure indicators should be evaluated together.

Özet

Dijital bankacılık kanallarının yaygınlaşmasıyla birlikte kimlik avı temelli sahte yönlendirme saldırıları, finans sektörünü hedef alan en kritik siber tehditlerden biri hâline gelmiştir. Ulusal Siber Olaylara Müdahale Merkezi (USOM) tarafından yayımlanan veriler, Türkiye’de zararlı bağlantı sayısının yüz binler seviyesine ulaştığını ve yerel ölçekte yürütülen oltalama kampanyalarının süreklilik kazandığını göstermektedir. Bu çalışma, e-bankacılık kullanıcılarını hedef alan gerçek bir oltalama vakasını alan adı manipülasyonu, klon web arayüzleri ve ters vekil sunucu tabanlı oturum ele geçirme yöntemleri açısından adli analiz yaklaşımıyla incelemektedir. Analiz kapsamında alan adı tescil bilgileri, barındırma altyapısı, sertifika özellikleri, yönlendirme akışı ve HTML kod yapısı çok katmanlı bir çerçevede değerlendirilmiştir. Bulgular, saldırganların kimlik bilgisi toplama ve oturum ele geçirme girişimlerini desteklemek için kısa ömürlü ve hızlı değişen alan adı altyapılarını kullandığını göstermektedir. Ayrıca USOM verileriyle desteklenen adli iz göstergeleri belirlenerek benzer saldırıların erken tespitine katkı sağlanmıştır. Sonuçlar, oltalama saldırılarına karşı yalnızca kullanıcı farkındalığının yeterli olmadığını; DNS, içerik, sertifika ve altyapı göstergelerinin birlikte değerlendirilmesi gerektiğini ortaya koymaktadır.

🔖

Cite This Article

Kara, İ. (2026). Analysis of e-banking phishing via cloned web interfaces: Attack vectors and detection approaches. Niğde Ömer Halisdemir Üniversitesi Mühendislik Bilimleri Dergisi, Cilt: 17. https://doi.org/10.28948/ngumuh.1812200

📄 Full Text PDF Viewer

📄

PDF görüntüleyici hazırlanıyor...

References (21)

  1. Positive Technologies, “Cybersecurity threatscape: financial industry 2023-2024,” Positive Technologies, 2024.
  2. M. Aburrous, M. A. Hossain, K. Dahal and F. Thabtah, “Experimental case studies for investigating e-banking phishing techniques and attack strategies,” Cognitive Computation, 2(3), 242-253, 2010. https://doi.org/10.1007/s12559-010-9042-7
  3. USOM, “Zararlı bağlantılar veri tabanı,” Ulusal Siber Olaylara Müdahale Merkezi, 2025. https://www.usom.gov.tr
  4. P. Smaga, “Profiling the victim - cyber risk in commercial banks,” Computers & Security, 150, 104274, 2025. https://doi.org/10.1016/j.cose.2024.104274
  5. V. Laxman, N. Ramesh, S. K. Jaya Prakash and R. Aluvala, “Emerging threats in digital payment and financial crime: A bibliometric review,” Journal of Digital Economy, 3, 205-222, 2025. https://doi.org/10.1016/j.jdec.2025.04.002
  6. I. Riasat, M. Shah and M. S. Gonul, “Strengthening cybersecurity resilience: An investigation of customers’ adoption of emerging security tools in mobile banking apps,” Computers, 14(4), 129, 2025. https://doi.org/10.3390/computers14040129
  7. B. Naqvi, K. Perova, A. Farooq, I. Makhdoom, S. Oyedeji and J. Porras, “Mitigation strategies against the phishing attacks: A systematic literature review,” Computers & Security, 132, 103387, 2023. https://doi.org/10.1016/j.cose.2023.103387
  8. P. Smaga, “Profiling the victim-cyber risk in commercial banks.” Computers & Security, 150, 104274, 2025. https://doi.org/10.1016/j.cose.2024.104274
  9. W. Yuspin, A. O. Putri, A. Fauzie and J. Pitaksantayothin, “Digital banking security: Internet phishing attacks, analysis and prevention of fraudulent activities,” International Journal of Safety and Security Engineering, 14(6), 1699-1706, 2024. https://doi.org/10.18280/ijsse.140605
  10. K. Althobaiti and N. Alsufyani, “A review of organization-oriented phishing research,” PeerJ Computer Science, 10, e2487, 2024. https://doi.org/10.7717/peerj-cs.2487
  11. R. Jabir, J. Le and C. Nguyen, “Phishing attacks in the age of generative artificial intelligence: A systematic review of human factors,” AI, 6(8), 174, 2025. https://doi.org/10.3390/ai6080174
  12. İ. Kara, “Don’t bite the bait: Phishing attack for internet banking (e-banking),” Journal of Digital Forensics, Security and Law, 16(2), Article 5, 2021. https://doi.org/10.58940/1558-7223.1743
  13. İ. Kara, “Electronic banking (e-banking) fraud with phishing attack methods,” Avrupa Bilim ve Teknoloji Dergisi, (31), 982-985, 2021. https://doi.org/10.31590/ejosat.1002963
  14. T. Moore and R. Clayton, “Examining the impact of website take-down on phishing,” Electronic Commerce Research and Applications, 8(4), 195-207, 2009. https://doi.org/10.1016/j.elerap.2009.01.003
  15. S. Garera, N. Provos, M. Chew and A. D. Rubin, “A framework for detection and measurement of phishing attacks,” Proceedings of the 2007 ACM Workshop on Recurring Malcode, 1-8, 2007. https://doi.org/10.1145/1314389.1314391
  16. S. Marchal, J. François, R. State and T. Engel, “PhishStorm: Detecting phishing with streaming analytics,” IEEE Transactions on Network and Service Management, 11(4), 458-471, 2014. https://doi.org/10.1109/TNSM.2014.2377295
  17. Y. Zhang, J. I. Hong and L. F. Cranor, “CANTINA: A content-based approach to detecting phishing web sites,” Proceedings of the 16th International Conference on World Wide Web, 639-648, 2007. https://doi.org/10.1145/1242572.1242659
  18. A. Oest, Y. Safaei, A. Doupé, G. J. Ahn, B. Wardman and G. Warner, “Inside a phisher’s mind: Understanding the anti-phishing ecosystem through phishing kit analysis,” 2018 APWG Symposium on Electronic Crime Research (eCrime), 1-12, 2018. https://doi.org/10.1109/eCrime.2018.8384345
  19. T. D. Wagner, K. Mahbub, E. Palomar and A. E. Abdallah, “Cyber threat intelligence sharing: Survey and research directions,” Computers & Security, 87, 101589, 2019. https://doi.org/10.1016/j.cose.2019.101589
  20. Y. Sakurai, T. Watanabe, T. Okuda, M. Akiyama and T. Mori, “Identifying the phishing websites using the patterns of TLS certificates,” Journal of Cyber Security and Mobility, 10(2), 451-486, 2021. https://doi.org/10.13052/jcsm2245-1439.1026
  21. C. W. Churchman and R. L. Ackoff, “An approximate measure of value,” Journal of the Operations Research Society of America, 2(2), 172-187, 1954. https://doi.org/10.1287/opre.2.2.172