Phishing on brand-new infrastructure.
Modern phishing pages live for hours on domains registered days ago, draw fake browser windows, or are generated in memory where URL filters can’t see them. The browser sees all of it.
Domain Age Guard
RDAP registration dates for the page and for every third-party script and WebSocket host it loads. Anything younger than 30 days (configurable) is flagged.
Browser-in-the-browser
Pages that draw a fake address bar and window chrome around a login form are recognised by their structure.
Blob-URL phishing
Login pages generated in memory with blob: URLs, invisible to network filters, are detected in the page.
Redirect cloakers
Redirect → new domain → phishing or ClickFix page is correlated into one suspicious redirect chain.
Credential forms on new domains
A password field on infrastructure registered days ago raises a precaution event and the site’s risk score.
Fleet-wide Intelligence
In the console, every site gets a risk score that includes how many devices met it and which signals it produced.
See the whole path to the page
- Where the user came from and every redirect before the phishing page — search ads, web mail, link shorteners, cloakers — in the first lines of the incident.
- Adversary-in-the-middle kits for Microsoft and ten more identity providers, recognised by the structure of the real sign-in page served from the wrong host.
- Campaigns: the same kit, worker or payload host on several sites becomes one infrastructure in the console, drawn on the campaign map and in the investigation graph.
Read the guideAiTM phishing: how attackers bypass MFA
Want to see it on your own browsers?
Free protection for everyone; trials, proofs of concept and pilots for teams.