Study: Most phishing pages are abandoned or disappear in a matter of days>
Tech Republic – Brandon Vigliarolo
Kaspersky’s in-depth analysis of phishing websites found that nearly three quarters of all phishing pages stop showing signs of activity within 30 days. A quarter of those are dead within 13 hours, and half last no more than 94 hours, or just under 4 days.

Kaspersky pulled a total of 5,310 links identified as bad by its anti-phishing engine, and tracked those pages over the course of 30 days. “Over a thirty-day period from the moment a “phishing” verdict was assigned to a page, the analysis program checked each link every two hours and saved the response code issued by the server as well as the text of the retrieved HTML page,” Kaspersky said.

Pages also occasionally change something on the back end, which causes their MD5 hashes to change and phishing filters to not recognize the page if it uses hashes to identify content.

Kasperksy breaks its data down even further, grouping pages by four formal criteria: Date of domain creation, top level domain (like .com or .org), location of the phishing page on the website’s directory (root or somewhere else), and domain level where the page is located.
Link: https://www.techrepublic.com/article/study-most-phishing-pages-are-abandoned-or-disappear-in-a-matter-of-days/