Our results improve our understanding of phishing messages,
both in the attack behavior and phishing identification
features. However, our study also shows the need for further
research on phishing. The large amount of duplication could
be cause to look into signature-based content filters. Also, the
strong indicators of phishing turned out to be transitory and
therefore have limited utility for email filters. The pervasive
features also have limited utility due the presence of these
features in legitimate messages. These findings show the
adaptive construction of phishing messages in each attack,
carefully removing the transitory features that cause their
identification by email filters. A serious challenge in phishing
research is finding strong indicators of phishing that are less
transitory.