  Phishing is a way of stealing people's sensitive information such as
username, password and banking details by disguising as a legitimate entity
(i.e. email, website). Anti-phishing education considered to be vital in
strengthening "human", the weakest link in information security. Previous
research in anti-phishing education focuses on improving educational
interventions to better interact the end user. However, one can argue that
existing anti-phishing educational interventions are limited in success due to
their outdated teaching content incorporated. Furthermore, teaching outdated
anti-phishing techniques might not help combat contemporary phishing attacks.
Therefore, this research focuses on investigating the obfuscation techniques of
phishing URLs used in anti-phishing education against the contemporary phishing
attacks reported in PhishTank.com. Our results showed that URL obfuscation with
IP address has become insignificant and it revealed two emerging URL
obfuscation techniques, that attackers use lately, haven't been incorporated
into existing anti-phishing educational interventions.
