A Monday Morning That Looked Routine Until It Wasn't
A regional insurance company's SOC received a routine phishing report from an employee who had hovered over a link in a suspicious email before clicking. The URL looked legitimate enough at first glance: a subdomain of what appeared to be a well-known document-sharing service, with HTTPS and a valid certificate. The automated email gateway scored it clean. The sandbox detonation returned nothing because the page was geofenced to serve the payload only to IP ranges associated with the company's state. By the time the analyst escalated, three other employees had clicked, and one had submitted credentials.
This scenario is not hypothetical. It reflects what threat actors are doing consistently across industries in 2025 and into 2026, where ESET's H1 2026 threat report confirms phishing infrastructure has become increasingly evasion-aware, serving benign content to scanners and malicious content to targets with surgical precision. The gap that lets these campaigns succeed is rarely a failure of awareness training. It is a failure of detection architecture.
Understanding how phishing URLs actually evade modern defenses requires moving beyond surface-level indicators and building a multi-layered inspection pipeline that accounts for how attackers construct, rotate, and weaponize infrastructure.
Why Surface Indicators Fail Against Modern Campaigns
Most URL filtering solutions were built around heuristics that made sense when phishing was simpler. Detecting misspellings of brand names, flagging newly registered domains, and checking against known-bad lists were effective when attackers used bulk, unsophisticated infrastructure. That era is largely over.
Modern phishing URLs frequently use legitimate cloud hosting providers, content delivery networks, and even compromised subdomains of trusted organizations. The GeoServer exploitation campaign documented in mid-July 2025 demonstrated how attackers pivot from vulnerability exploitation to infrastructure abuse within hours, using trusted hosting environments as launchpads. A URL living on a compromised government or university subdomain will pass every reputation check in your stack because those domains carry decades of positive history.
Certificate presence is another indicator that has lost most of its signal value. Let's Encrypt and similar services have made TLS certificates free and nearly instantaneous to provision. Attackers routinely acquire valid certificates for their phishing domains hours before launching a campaign. Flagging a URL as suspicious because it lacks HTTPS is reasonable. Treating HTTPS as a trust signal is a miscalibration that creates false confidence.
Lexical Analysis: What the URL String Itself Tells You
Before a URL is ever fetched, its structure carries meaningful signals. Lexical analysis examines the raw string without making any network requests, which makes it fast, scalable, and safe to run on high-volume traffic.
Key features worth extracting and scoring include:
- Subdomain depth and complexity: Phishing URLs frequently bury the malicious domain in a long chain of subdomains. A URL like secure-login.account-verify.microsoft.com.maliciousdomain.xyz exploits human visual parsing by placing the familiar brand name early in the string. Automated parsers must correctly identify the registrable domain, not just scan for keywords.
- Path and query string entropy: Legitimate authentication URLs have predictable, low-entropy structures. Phishing URLs often contain long random strings in the path or query parameters that serve as campaign tracking tokens or fingerprinting mechanisms. High Shannon entropy in these components is a meaningful signal.
- Brand keyword injection: Extracting all recognizable brand names from the full URL and comparing them against the registrable domain catches a high proportion of credential harvesting pages. A URL containing the word paypal where the registrable domain resolves to a recently registered generic domain is a strong phishing indicator regardless of what the page renders.
- Use of URL shorteners and redirectors: Any URL that routes through a shortening service or an open redirect on a legitimate domain should be automatically expanded and re-evaluated. Open redirects on legitimate domains are particularly dangerous because the initial domain passes reputation checks while the final destination is the actual threat.
- Homograph and punycode abuse: Internationalized domain names allow character substitution that is visually indistinguishable in many fonts. Detection systems must normalize punycode representations before any comparison.
Lexical analysis alone will not catch everything, but it is computationally cheap and can operate at email gateway scale before any network calls are made. It functions best as a first-pass triage layer that routes high-scoring URLs into deeper inspection queues.
Domain and Infrastructure Intelligence
Once a URL passes lexical analysis without being immediately flagged, infrastructure-level investigation provides the next layer of signal. This is where passive DNS, WHOIS history, and hosting context become actionable.
Domain age is a known signal, but it requires nuance. Attackers have adapted by purchasing aged domains with positive history, using domain parking services to age domains before activating them for campaigns, or compromising legitimate aged domains entirely. Raw registration date is less reliable than it was two years ago. What matters more is the delta between registration or transfer date and the date the domain became active for the observed URL pattern.
Hosting infrastructure context provides strong signal when combined with other indicators. A domain registered recently, resolving to an IP address in an autonomous system that has no prior history of hosting content for that industry vertical, sharing that IP with dozens of other recently registered domains, represents a meaningful cluster of risk. This type of infrastructure fingerprinting is how researchers have tracked campaigns like those documented in the July 2025 threat intelligence reports, where bulk phishing infrastructure was identified through shared hosting patterns before individual domains appeared on threat feeds.
Passive DNS analysis lets you ask whether this domain has been resolving to the same IP consistently, or whether it rotates aggressively. Fast-flux DNS, where a domain cycles through large numbers of IP addresses at short TTLs, is a strong indicator of malicious intent. Most legitimate services do not need to rotate nameservers or A records every few minutes.
Reverse lookups on the hosting IP reveal co-hosted domains. If a suspicious domain shares an IP with dozens of other domains that follow similar naming patterns, that co-hosting relationship is strong corroborating evidence. Threat intelligence platforms that maintain current IP-to-domain mapping make this lookup fast enough to include in real-time detection workflows.
Behavioral Analysis Through Controlled Fetching
For URLs that survive lexical and infrastructure analysis without triggering confident blocks, controlled fetching and behavioral analysis provide the deepest inspection capability. This is where browser-based sandboxing earns its place in the stack.
The challenge is that sophisticated phishing kits are now fingerprint-aware. They check for headless browser signatures, detect sandbox IP ranges, inspect the user-agent string and browser capabilities, and serve benign content when they suspect automated analysis. The insurance company scenario from the opening of this article is a real operational problem: geofenced payloads that only activate for specific visitor profiles.
Mitigating sandbox evasion requires several adjustments to how you operate controlled fetching infrastructure:
- Rotating residential proxy egress: Fetching through residential IP addresses that match the targeted geography dramatically reduces the effectiveness of IP-based evasion. A phishing page geofenced to serve payloads only to visitors from a specific city will not detect the sandbox if the sandbox egresses through a residential IP in that city.
- Realistic browser fingerprinting: Headless browsers expose themselves through missing or inconsistent browser API implementations. Using full browser instances with realistic viewport sizes, fonts, plugins, and behavioral patterns reduces detection rates significantly.
- Time-delayed fetching: Some phishing kits only activate after a campaign has been running for a period of time, or deactivate after detecting rapid sequential visits from the same source. Staggering fetch attempts and using different source identities mimics more realistic traffic patterns.
- Screenshot and DOM comparison: Visual similarity scoring against known legitimate brand login pages catches pages that render as convincing imitations even when the underlying code has been obfuscated. OCR-based extraction of form labels and page text feeds into brand impersonation classifiers without depending on code structure alone.
What you are looking for during behavioral analysis is any combination of credential form presence, brand impersonation indicators in rendered content, redirection chains that terminate at a different domain than the original URL, and page behavior that differs between fetch attempts.
Machine Learning Classifiers in URL Detection Pipelines
Rule-based detection reaches its ceiling quickly against adversaries who study and adapt to those rules. Machine learning classifiers operating on the feature sets described above provide detection coverage that extends into the space between known-bad indicators.
The most effective deployed architectures use ensemble approaches that combine several model types. Gradient boosting models trained on lexical features handle the structured numerical data extracted from URL strings efficiently and with high interpretability. Deep learning models, particularly character-level convolutional networks or recurrent architectures, capture sequential patterns in URL strings that resist feature engineering. Trained on large corpora of confirmed phishing and legitimate URLs, these models generalize to novel phishing domains that share structural characteristics with previously seen campaigns without matching specific indicators.
Training data quality is the most significant practical challenge. Models trained on historical phishing data that skews toward older, simpler campaigns will underperform against modern evasion techniques. Continuous retraining pipelines that incorporate newly confirmed phishing URLs from user reports, threat intelligence feeds, and honeypot captures keep classifier performance current. The ESET H1 2026 threat report noted consistent evolution in phishing kit sophistication across the first half of the year, which means any static trained model will degrade meaningfully within weeks in a high-volume threat environment.
Model explainability matters operationally. When a classifier flags a URL and an analyst needs to make a rapid decision about blocking or investigating, understanding which features drove the score allows faster validation. Black-box scores that provide no feature attribution slow investigation workflows and reduce analyst confidence in the system.
Real-Time Signals: Captive Portal Behavior and Protocol Abuse
An underappreciated detection surface involves how phishing pages interact with browser security mechanisms and network-level protocols. Captive portal detection behavior, documented in recent SANS ISC research from July 2025, revealed interesting patterns in how malicious pages interact with captive portal detection endpoints built into operating systems and browsers.
Legitimate captive portals respond to specific connectivity check requests in predictable ways. Phishing pages hosted on infrastructure that mimics captive portal behavior to redirect users through credential collection flows show distinctive response patterns when those connectivity checks are intercepted and inspected. Network-level monitoring that captures responses to operating system captive portal probes can surface phishing pages that would be invisible to URL inspection happening only at the email gateway.
IPv6 deserves specific attention. As noted in recent discussions of IPv6-enabled phishing infrastructure, URL blocklists that maintain only IPv4 records miss campaigns that use AAAA records exclusively or that serve malicious content via IPv6 while serving benign content to IPv4-only scanners. Any URL inspection pipeline that does not resolve and inspect both IPv4 and IPv6 addresses associated with a domain has a structural blind spot that attackers are actively exploiting.
Operationalizing Detection at Scale
Detection techniques only deliver value if they integrate into inspection workflows that match your traffic volume and response time requirements. A pipeline that produces accurate results but takes four minutes per URL is not compatible with real-time email delivery or web proxy filtering.
A practical layered architecture looks like this: lexical analysis runs synchronously at the email gateway, completing in milliseconds per URL and producing a confidence score. URLs scoring below a safe threshold pass immediately. URLs scoring above a block threshold are rejected. The middle range, typically 20 to 40 percent of URLs depending on traffic profile, routes to an asynchronous enrichment queue.
The enrichment queue applies infrastructure intelligence lookups, passive DNS analysis, and machine learning scoring. Results that complete within the email delivery window, usually a few seconds, feed back into the gateway decision in real-time. URLs that take longer to analyze are delivered with a warning or held pending manual review, depending on your risk tolerance and the email's other risk signals.
Web proxy integration applies the same logic to clicked URLs, catching phishing links that arrived through channels outside your email inspection, including SMS, messaging platforms, and QR codes. Browser-level protection that re-evaluates URLs at click time, rather than only at delivery time, addresses the time gap between when a URL was scanned and when it was clicked, during which the destination may have been weaponized.
Threat Intelligence Integration and Feedback Loops
No detection pipeline operates in isolation. Connecting URL inspection outputs to broader threat intelligence infrastructure multiplies the value of each confirmed detection.
When a URL is confirmed as phishing through sandbox analysis or analyst investigation, the registrable domain, hosting IP, certificate fingerprint, and infrastructure relationships should automatically propagate to your blocking infrastructure and to any threat sharing programs your organization participates in. Given the current acceleration in ransomware and fraud campaigns documented across July 2025 threat intelligence reports, including the office printer extortion campaigns and fraud operations that combine multiple initial access techniques, early sharing of phishing infrastructure indicators provides measurable time advantage to organizations downstream of your detection.
Internally, confirmed phishing URLs from user reports are among the highest-quality training signals available. A user who recognized and reported a phishing attempt before clicking has provided a ground-truth positive that, combined with the full URL and its infrastructure context, directly improves classifier performance when fed back into the retraining pipeline. Organizations that build structured user reporting workflows and close the loop by connecting those reports to model retraining consistently outperform organizations that treat user reports as isolated incident records.
Where to Start If Your Pipeline Has Gaps
For security teams assessing their current URL detection coverage, three areas consistently reveal the largest gaps:
- Open redirect handling: Run a test against your current email gateway by sending URLs that use open redirects on trusted domains to route to clearly malicious destinations. If those URLs pass without triggering redirect expansion and re-evaluation of the final destination, you have a structural gap that attackers actively exploit.
- IPv6 coverage: Verify that your URL analysis resolves AAAA records and inspects IPv6-hosted content, not just IPv4. Many commercial solutions have this gap and do not document it clearly in their feature specifications.
- Sandbox IP diversity: If your controlled fetching infrastructure always egresses from the same IP blocks, those blocks are almost certainly known to commodity phishing kits, which will serve benign content to them. Test your sandbox by fetching known phishing pages that were previously confirmed active and verifying that the sandbox receives the malicious version rather than a decoy.
URL-based phishing detection is a discipline that requires ongoing adversarial calibration. Attackers study what detection systems look for and build evasion directly into their infrastructure. Detection pipelines that were accurate six months ago have measurable blind spots today. Regular red team exercises that simulate current phishing kit behavior, combined with continuous retraining of ML components and active participation in threat intelligence sharing, are what separate detection infrastructure that holds against current campaigns from infrastructure that only catches the campaigns from last year.
