Which of the following is primarily a database of phishing-related indicators?

Which of the following is primarily a database of phishing-related indicators?

• A. Honeypot
• B. Yara Rules
• C. PhishSigs
• D. EDR

Answer: (C)

Phishing indicators are best handled by a specialized repository that stores known signs of phishing campaigns—things like suspicious URLs and domains, sender addresses, subject patterns, and related network indicators. That kind of focused database lets security tools quickly compare incoming messages or web requests against documented phishing artifacts to block or flag them. PhishSigs is designed for this purpose, serving as a central library of phishing-related indicators that defenders can use to detect and respond to phishing attempts. Honeypots are decoys meant to lure attackers and study their behavior, not a database of phishing indicators. Yara Rules are pattern-based signatures used to identify malware or suspicious files, not specifically a repository of phishing indicators. EDR (Endpoint Detection and Response) is a broad security platform that gathers telemetry from endpoints and orchestrates detections and responses, rather than hosting a dedicated phishing indicator database.

Phishing indicators are best handled by a specialized repository that stores known signs of phishing campaigns—things like suspicious URLs and domains, sender addresses, subject patterns, and related network indicators. That kind of focused database lets security tools quickly compare incoming messages or web requests against documented phishing artifacts to block or flag them. PhishSigs is designed for this purpose, serving as a central library of phishing-related indicators that defenders can use to detect and respond to phishing attempts.

Honeypots are decoys meant to lure attackers and study their behavior, not a database of phishing indicators. Yara Rules are pattern-based signatures used to identify malware or suspicious files, not specifically a repository of phishing indicators. EDR (Endpoint Detection and Response) is a broad security platform that gathers telemetry from endpoints and orchestrates detections and responses, rather than hosting a dedicated phishing indicator database.