A regional bank blocked every domain on its phishing feed for a week and still lost MFA-bound credentials. The lure arrived as SMS traffic claiming an Okta session reset. The link used a freshly registered domain with a clean reputation score. The path looked like /sso/okta/verify?session= plus a long base64 blob. Secure email gateway (SEG) domain checks passed. URL rewrite ran. The employee authenticated on a cloned portal before the sinkhole listing existed.
That pattern matches how crews such as 0ktapus scale credential theft across dozens of firms: short-lived domains, identity-provider branding in the path or query string, and pages that go live only long enough to collect one login wave. Domain reputation alone arrives late. Path layout scoring catches the lure while the hostname still looks unused.
Why hostname reputation misses the first wave
Most mail and web filters score the registrable domain, TLS certificate age, and prior abuse hits. Phishing operators buy or compromise hostnames that have never appeared on a feed. They serve HTTPS with cheap certificates. They rotate the apex every few hours. Your deny lists stay quiet until victims already typed passwords.
0ktapus-style campaigns lean on SMS and collaboration-app messages, which often bypass the SEG path your email policies assume. When the click happens on a phone browser, corporate proxy controls may never see the request. Detection that waits for an IP or domain match on a shared abuse feed therefore starts after credential theft, not before.
Parallel pressure comes from AI-assisted OSINT and brand cloning. Attackers scrape public help-desk pages, logo kits, and trusted AI chat interfaces to assemble convincing login copy overnight. PuzzleMask-style prose obfuscation and SEO abuse of compromised government sites show the same lesson: the malicious asset can look linguistically and visually ordinary while the URL structure still encodes the brand the victim expects.
What to score inside the URL itself
Treat every inbound URL as a structured object: scheme, host, path segments, query keys, fragment, and redirect hops. Assign points when identity and finance brand tokens appear outside the legitimate registrable domain.
Brand token placement
Legitimate Okta, Microsoft, Google, and Duo URLs keep the brand in the hostname owned by the vendor or your tenant. Phishing pages push those tokens into path segments (/okta/, /m365-login/, /duo-prompt/) or query values (brand=okta, provider=azure). Build a controlled vocabulary of tokens your users recognize for SSO, payroll, VPN, and benefits portals. Flag any URL whose hostname is not in your allowlist of known identity providers yet whose path or query contains those tokens.
Login path templates
Clone kits reuse path skeletons: /auth/login, /session/verify, /oauth/authorize, /account/signin, plus decoy file names like index.php or verify.html. Score combinations of shallow path depth, authentication verbs, and file extensions uncommon on your corporate allowlisted SaaS hosts. Weight rises when those templates coincide with a domain younger than seven days or a certificate issued within 48 hours.
Query entropy and session theater
Phishing pages pad URLs with long opaque parameters that mimic session state. High-entropy query values paired with brand tokens and a login template are a strong signal. Legitimate vendor URLs also use long parameters; the difference is hostname ownership. Require both structure and ownership checks before you quarantine.
Redirect chain ownership
Operators still launder clicks through URL shorteners, marketing trackers, and compromised content sites. Resolve each hop server-side and re-score brand tokens after expansion. If hop one is a known shortener and hop two places okta in the path on an unrelated apex, treat the whole chain as hostile even when the first host has a clean reputation.
Wire detection where clicks actually happen
Email gateways remain necessary and incomplete. Extend the same URL object scoring to:
- Secure web gateways and DNS resolvers that see phone and remote-worker traffic
- Chat and collaboration link unfurling (Teams, Slack, email signatures pasted into tickets)
- SMS and voice callback programs that hand users a typed URL or QR destination
- Browser isolation or URL detonation queues already used for attachment sandboxes
Detonate suspicious URLs in an isolated browser farm. Capture final DOM brand assets, form field names (username, password, otp), and whether the page posts credentials to a third-party host. Feed those outcomes back into the path-layout scorer so tomorrow’s kit variants inherit yesterday’s template weights.
A practical scoring pipeline you can run this quarter
- Normalize and expand every URL; strip tracking parameters you already allowlist.
- Classify the hostname against vendor allowlists, your own domains, and certificate transparency age.
- Extract path tokens and query keys; match against the brand vocabulary and login templates.
- Compute a composite score: brand-out-of-host + login template + young domain + high-entropy session parameters + redirect ownership mismatch.
- Route mid scores to quarantine with analyst review; auto-block high scores; allow low scores with logging for drift analysis.
- On confirmed phishing, store the path template fingerprint (not only the domain) so the next apex reuse still matches.
Keep thresholds tunable per channel. SMS and executive-targeted mail deserve a lower auto-block bar than newsletter footers. Document false-positive classes: vendor status pages that put product names in paths, partner portals on shared hosting, and marketing microsites that reuse /login for newsletter preference centers.
Tradeoffs and operational caveats
Brand vocabularies drift. New SaaS tools introduce tokens that look like phishing until you add them to the allowlist. Review weekly with identity and procurement so legitimate rollout domains do not sit in quarantine for days.
Young-domain signals punish legitimate startups and new campaign microsites. Pair age with structure; age alone should raise scrutiny, not auto-remediation, unless other scores already fire.
Detonation farms leak victim identity if you replay personalized tokens from the original lure. Strip or rewrite session parameters before sandbox fetch. Prefer HEAD/GET of the landing page without submitting forms that contain user-specific IDs.
Mobile SMS clicks may never hit your proxy. Combine user education with MDM-managed browsers, DNS filtering on corporate devices, and rapid credential reset playbooks when a scored URL was opened from an unmanaged phone.
Trusted AI platforms and public chat tools now host attacker-generated “help” pages and QR destinations. Treat links that originate from AI assistants the same as email: expand, score path layout, and detonate before employees paste them into corporate SSO.
Failure case remediation checklist
When a first-use domain already stole credentials, run this sequence in parallel:
- Force step-up reauthentication and revoke sessions for the affected IdP applications
- Search mail, chat, and DNS logs for the path template fingerprint across other apexes
- Add the template and brand-out-of-host rule to the live scorer within the same shift
- Notify peer SOCs and ISACs with the path pattern, not only the burned domain
- Review SMS and help-desk callback procedures that attackers abused to deliver the link
Microsoft’s ongoing flood of patched vulnerabilities and malware trend reports for 2026 reinforce the same operational truth: endpoint patching and feed-based IP blocking do not stop a convincing login URL on a clean hostname. URL structure analysis closes that gap.
Takeaways for security and IT teams
Score brand tokens in paths and queries against hostname ownership before you trust a reputation verdict. Fingerprint login path templates so rotating domains keep matching. Expand and re-score redirect chains server-side. Detonate mid-score URLs in isolation and feed DOM and form signals back into the model. Cover SMS, chat, and DNS paths where SEG rewrite never runs. Tune by channel, maintain the brand vocabulary with identity owners, and treat confirmed kits as template intelligence you share upstream of the next apex registration.
First-use phishing domains will keep looking clean on day zero. Login path layouts already tell you the page is a fake SSO gate. Put that signal in front of the click.
