{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,13]],"date-time":"2026-04-13T17:40:54Z","timestamp":1776102054549,"version":"3.50.1"},"reference-count":28,"publisher":"Emerald","issue":"4","license":[{"start":{"date-parts":[[2016,10,10]],"date-time":"2016-10-10T00:00:00Z","timestamp":1476057600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.emerald.com\/insight\/site-policies"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["ICS"],"published-print":{"date-parts":[[2016,10,10]]},"abstract":"<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Purpose<\/jats:title>\n<jats:p>Phishing is still a very popular and effective security threat, and it takes, on average, more than a day to detect new phish websites. Protection by purely technical means is hampered by this vulnerability window. During this window, users need to act to protect themselves. To support users in doing so, the paper aims to propose to first make users aware of the need to consult the address bar. Moreover, the authors propose to prune URL displayed in the address bar. The authors report on an evaluation of this proposal.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Design\/methodology\/approach<\/jats:title>\n<jats:p>The paper opted for an online study with 411 participants, judging 16 websites \u2013 all with authentic design: half with legitimate and half with phish URLs. The authors applied four popular widely used types of URL manipulation techniques. The authors conducted a within-subject and between-subject study with participants randomly assigned to one of two groups (domain highlighting or pruning). The authors then tested both proposals using a repeated-measures multivariate analysis of variance.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Findings<\/jats:title>\n<jats:p>The analysis shows a significant improvement in terms of phish detection after providing the hint to check the address bar. Furthermore, the analysis shows a significant improvement in terms of phish detection after the hint to check the address bar for uninitiated participants in the pruning group, as compared to those in the highlighting group.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Research limitations\/implications<\/jats:title>\n<jats:p>Because of the chosen research approach, the research results may lack generalisability. Therefore, researchers are encouraged to test the proposed propositions further.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Practical implications<\/jats:title>\n<jats:p>This paper confirms the efficacy of URL pruning and of prompting users to consult the address bar for phish detection.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Originality\/value<\/jats:title>\n<jats:p>This paper introduces a classification for URL manipulation techniques used by phishers. We also provide evidence that drawing people\u2019s attention to the address bar makes them more likely to spot phish websites, but does not impair their ability to identify authentic websites.<\/jats:p>\n<\/jats:sec>","DOI":"10.1108\/ics-07-2015-0032","type":"journal-article","created":{"date-parts":[[2016,10,19]],"date-time":"2016-10-19T09:36:10Z","timestamp":1476869770000},"page":"372-385","source":"Crossref","is-referenced-by-count":11,"title":["Spot the phish by checking the pruned URL"],"prefix":"10.1108","volume":"24","author":[{"given":"Melanie","family":"Volkamer","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Karen","family":"Renaud","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Paul","family":"Gerber","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"140","reference":[{"key":"key2020121219483789700_ref001","article-title":"Alice in warningland: a large-scale field study of browser security warning effectiveness","year":"2013"},{"key":"key2020121219483789700_ref002","first-page":"405","article-title":"An anti-phishing approach that uses training intervention for phishing websites detection","year":"2009"},{"key":"key2020121219483789700_ref003","unstructured":"APWG Internet Policy Committee (2013), \u201cGlobal phishing survey: trends and domain name use in 2h2013\u201d, available at: http:\/\/docs.apwg.org\/reports\/APWG_GlobalPhishingSurvey_2H2013.pdf"},{"key":"key2020121219483789700_ref004","unstructured":"APWG Internet Policy Committee (2014), \u201cPhishing activoty trends report. 2nd quarter\u201d, available at: https:\/\/apwg.org\/resources\/apwg-reports\/"},{"issue":"1","key":"key2020121219483789700_ref005","article-title":"Do not crawl in the DUST: different URLs with similar text","volume":"3","year":"2009","journal-title":"ACM"},{"key":"key2020121219483789700_ref006","first-page":"188","article-title":"Nophish: an antiphishing education app","volume-title":"Security and Trust Management","year":"2014"},{"key":"key2020121219483789700_ref007","first-page":"581","article-title":"Why phishing works","year":"2006"},{"key":"key2020121219483789700_ref008","first-page":"1065","article-title":"You\u2019ve been warned: an empirical study of the effectiveness of web browser phishing warnings","year":"2008"},{"key":"key2020121219483789700_ref009","first-page":"1","article-title":"A framework for detection and measurement of phishing attacks","year":"2007"},{"key":"key2020121219483789700_ref010","first-page":"74","article-title":"Simulating malicious emails to educate end users on-demand","year":"2011"},{"issue":"2","key":"key2020121219483789700_ref011","doi-asserted-by":"crossref","first-page":"24","DOI":"10.1109\/MSP.2011.179","article-title":"Security education against phishing: a modest proposal for a major rethink","volume":"10","year":"2012","journal-title":"IEEE Security and Privacy Magazine"},{"key":"key2020121219483789700_ref012","unstructured":"Kuhn, B.-L. (2013), \u201cTop-Statistik: aktuelle Bildschirmaufloesungen im Juli 2013 (Screenshot Resolution in July 2013)\u201d, available at: www.proteus-solutions.de\/\u223cUnternehmen\/News-PermaLink:tM.F06!sM.PV00!Article.955799.asp"},{"key":"key2020121219483789700_ref013","unstructured":"Kumaraguru, P., Rhee, Y., Acquisti, A., Cranor, L.F., Hong, J. and Nunge, E. (2007), \u201cProtecting people from phishing: the design and evaluation of an embedded training email system\u201d, Proceedings of the SIGCHI Conference on Human Factors in Computing Systems\u2019, San Jose, CA, CHI \u201807, ACM, New York, NY, pp. 905-914, http:\/\/doi.acm.org\/10.1145\/1240624.1240760."},{"key":"key2020121219483789700_ref015","article-title":"Anti-phishing landing page: turning a 404 into a teachable moment for end users","year":"2009"},{"key":"key2020121219483789700_ref014","unstructured":"Kumaraguru, P., Rhee, Y., Sheng, S., Hasan, S., Acquisti, A., Cranor, L.-F. and Hong, J. (2007), \u201cGetting users to pay attention to anti-phishing education: evaluation of retention and transfer\u201d, Proceedings of the Anti-Phishing Working Groups 2nd Annual eCrime Researchers Summit\u2019, eCrime \u201807, Pittsburgh, PA, ACM, New York, NY, pp. 70-81, http:\/\/doi.acm.org\/10.1145\/1299015.1299022"},{"issue":"2","key":"key2020121219483789700_ref016","doi-asserted-by":"crossref","first-page":"163","DOI":"10.1007\/s11416-007-0050-4","article-title":"Usability evaluation of anti-phishing toolbars","volume":"3","year":"2007","journal-title":"Journal in Computer Virology"},{"key":"key2020121219483789700_ref017","first-page":"2075","article-title":"Does domain highlighting help people identify phishing sites?","year":"2011"},{"key":"key2020121219483789700_ref018","first-page":"190","article-title":"Proactive discovery of phishing re-lated domain names","volume-title":"Research in Attacks, Intrusions, and Defenses\u2019","year":"2012"},{"key":"key2020121219483789700_ref020","first-page":"2","article-title":"Using data type based security alert dialogs to raise online security awareness","year":"2011"},{"key":"key2020121219483789700_ref019","article-title":"Using visual website similarity for phishing detection and reporting","year":"2012"},{"issue":"9","key":"key2020121219483789700_ref021","doi-asserted-by":"crossref","first-page":"1105","DOI":"10.5588\/ijtld.13.0918","article-title":"Impact of awareness drives and community-based active tuberculosis case finding in Odisha, India","volume":"18","year":"2014","journal-title":"The International Journal of Tuberculosis and Lung Disease"},{"key":"key2020121219483789700_ref022","first-page":"346","article-title":"Phishnet: predictive blacklisting to detect phishing attacks","year":"2010"},{"key":"key2020121219483789700_ref023","first-page":"643","article-title":"Building castles in quick sand: blueprint for a crowdsourced study","year":"2014"},{"key":"key2020121219483789700_ref024","unstructured":"Sheng, S., Magnien, B., Kumaraguru, P., Acquisti, A., Cranor, L.F., Hong, J. and Nunge, E. (2007), \u201cAnti-phishing phil: the design and evaluation of a game that teaches people not to fall for phish\u201d, Proceedings of the 3rd Symposium on Usable Privacy and Security\u2019, SOUPS \u201807, ACM, New York, NY, pp. 88-99, http:\/\/doi.acm.org\/10.1145\/1280680.1280692."},{"key":"key2020121219483789700_ref025","unstructured":"StatCounter (2013), \u201cTop 14 screen resolutions in Germany from July to Dec 2013\u201d, available at: http:\/\/gs.statcounter.com"},{"key":"key2020121219483789700_ref026","unstructured":"Trend Micro Incorporated (2016), \u201cCybercriminals reinvent methods of malicious attacks\u201d, available at: www.crime-research.org\/analytics\/3451\/"},{"key":"key2020121219483789700_ref027","unstructured":"Wu, M., Miller, R.C. and Garfinkel, S.L. (2006), \u201cDo security toolbars actually prevent phishing attacks?\u201d, Proceedings of the SIGCHI Conference on Human Factors in Computing Systems\u2019, CHI \u201806, Paris, 27  April 2 May, ACM, New York, NY, pp. 601-610, available at: http:\/\/doi.acm.org\/10.1145\/1124772.1124863."},{"key":"key2020121219483789700_ref028","article-title":"Phinding phish: evaluating anti-phishing tools","year":"2007"}],"container-title":["Information &amp; Computer Security"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/www.emeraldinsight.com\/doi\/full-xml\/10.1108\/ICS-07-2015-0032","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/ICS-07-2015-0032\/full\/xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/ICS-07-2015-0032\/full\/html","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,25]],"date-time":"2025-07-25T01:23:01Z","timestamp":1753406581000},"score":1,"resource":{"primary":{"URL":"http:\/\/www.emerald.com\/ics\/article\/24\/4\/372-385\/107840"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,10,10]]},"references-count":28,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2016,10,10]]}},"alternative-id":["10.1108\/ICS-07-2015-0032"],"URL":"https:\/\/doi.org\/10.1108\/ics-07-2015-0032","relation":{},"ISSN":["2056-4961"],"issn-type":[{"value":"2056-4961","type":"print"}],"subject":[],"published":{"date-parts":[[2016,10,10]]}}}