Clean reputation scores and a green padlock still leave most phishing clicks unchallenged. Credential theft campaigns now ship with valid certificates, AI-written lure copy, and hostnames that sit one edit distance from your real portal. By the time a URL blocklist flips red, the password is already in a combo dump and the next login lands on your auth stack from a trusted carrier address.
That pattern matters this week. Quest Diagnostics confirmed a breach that exposed patient records, the kind of outcome phishing against healthcare portals is built to produce. Separate reporting on threat actors using AI to plan and execute multiple crime types shows how fast lure pages and lookalike domains can be generated. The EMudhra intermediate CA compromise also reminds operators that certificate trust is a living control, not a permanent seal of legitimacy.
Where detection programs stall
Most mail and web gateways still treat URL verdicts as a single vendor score. Analysts wait for domain age thresholds, blocklist hits, or a known phishing kit signature. That workflow fails against three common real-world patterns.
- Fresh lookalikes with fresh TLS. Registrants stand up quest-diagnostics-secure.com style hosts, obtain certificates within minutes, and mail the link the same afternoon.
- Compromised legitimate sites. Attackers drop a phishing path under a long-trusted domain, so reputation engines score the apex clean while the deep URL steals credentials.
- Short redirect chains through CDNs and link shorteners. The visible mail link looks benign. The final form host appears only after the click, outside the scanning window that ran at delivery.
IT administrators then inherit the failure as auth noise: MFA fatigue, password spray from residential proxies, or sudden geo drift on accounts that clicked a rewritten link hours earlier. Mail security and identity live in different tickets, so the URL that started the chain never joins the session that finishes it.
Feature set that catches clicks early
Build detection around structural URL features you already own in the mail gateway, secure email gateway (SEG) rewrite logs, and proxy. Vendor reputation remains one input. It should not be the gate that decides whether a link is challenged.
Brand token distance
Maintain a dictionary of high-value brand strings: your corporate name, SSO product names, HR and benefits portals, payroll, VPN gateways, and for healthcare environments the exact patient-portal product names users expect. Score every rewritten hostname for:
- Levenshtein or visual (homoglyph) distance to each brand token
- Brand token present as a subdomain of an unrelated registrable domain
- Hyphen and digit stuffing around the brand string
- TLD mismatch against your known legitimate hosts
Example rule for operators: any mail-borne URL whose hostname contains a brand token at distance ≤2 from a dictionary entry, on a registrable domain younger than 30 days or missing from your allow inventory, triggers rewrite quarantine or click-time interstitial. Do this before the domain appears on public phishing lists.
Redirect depth and final form host
At click time, follow redirects server-side up to a fixed depth (commonly 3–5) and evaluate the terminal host, not the first hop. Log each hop with status code, Location header host, and TLS certificate subject. Flag chains that:
- Exit a known shortener or marketing CDN onto a newly observed hostname
- Cross from an HTTPS first hop to a different registrable domain that hosts a login form
- Post credentials to a host that differs from the HTML form action domain shown to the user
Proxy or CASB policies should challenge or block the terminal host even when the original mail link passed delivery-time scanning.
Certificate novelty under trusted brands
After events like intermediate CA compromise disclosures, treat certificate metadata as an active phishing feature. For any host that mimics a brand portal, compare:
- Issuing CA against your historical baseline for that brand
- Certificate age versus domain registration age
- SAN entries that mix brand-like names with unrelated domains
A lookalike host with a brand-new certificate from an unexpected intermediate deserves the same severity as a low reputation score. Instruct SOC runbooks to open CT (Certificate Transparency) searches for your brand tokens on a daily cadence and feed hits into the same queue as SEG phishing tickets.
Path anomalies on clean apex domains
Compromised WordPress, forgotten marketing microsites, and abandoned apps remain favorite phishing hosts. Pair clean apex reputation with path and content checks:
- Login or MFA keywords under unusual paths (/wp-content/uploads/, random Base64 segments, numeric directories)
- Password fields posting to third-party collectors
- Pages that clone your SSO chrome but load scripts from a different ASN than your real IdP
Abandoned consumer apps that later expose devices to RCE show the same lesson for web properties: tenure without maintenance is an attacker asset. Inventory internet-facing sites the same way you inventory admin portals, and score odd paths on otherwise trusted hosts as phishing candidates.
Operational playbook for admins and SOC
Use a four-join workflow so URL features become identity actions within one shift window, without waiting for perfect attribution.
- Ingest rewrite telemetry. Export every SEG click: original URL, rewritten URL, user, mailbox, timestamp, and final redirect host.
- Score in near real time. Apply brand-token distance, domain age, redirect depth, and certificate novelty. Produce a 0–100 phishing URL risk score with explainable feature hits in the ticket.
- Join to auth. Within 15–60 minutes, correlate high-scoring clicks to SSO failures, MFA denials, new device registrations, and impossible-travel alerts for the same user. Auto-open an identity case when both sides fire.
- Contain on the identity plane. Prefer step-up MFA, session revoke, and temporary conditional-access tightening for the affected user over a global domain block that still lags the campaign.
Concrete implementation detail for Microsoft 365 or Google Workspace shops: pipe SEG click logs into your SIEM with a stable user key, create a scheduled rule that joins phishing_url_score ≥ 70 to auth_failure OR mfa_fatigue OR new_compliant_device in a ±2 hour window, and page the identity on-call with the terminal URL and certificate issuer already attached. Network-only blocks remain useful for shared infrastructure, yet they arrive after the password is typed.
Tabletop that keeps the playbook honest
Run a short exercise quarterly with mail, identity, and helpdesk together.
- Scenario A: Patient-portal lookalike mailed to staff and patients after a public healthcare breach notice. The URL has valid TLS and a clean vendor score at T+0. Measure time from first click to forced re-auth.
- Scenario B: AI-generated lure that references a real internal ticket number scraped from a prior leak. The link lands on a compromised marketing subdomain your brand owns. Measure whether path anomaly detection beats apex allowlisting.
- Scenario C: CT alert for a brand token on a new certificate issued under an unexpected intermediate after a CA trust advisory. Measure whether SOC treats the CT hit as phishing infrastructure before any mail volume appears.
Success criteria are operational, not academic: mean time from click to session revoke under 30 minutes for high-scoring URLs, and zero dependence on a public blocklist flip for containment.
What to ship this month
- Publish a brand-token dictionary owned by identity and marketing, reviewed whenever a new portal launches.
- Turn on click-time redirect following with terminal-host scoring in the SEG or secure web gateway.
- Add CT monitoring for your brand strings and wire hits to the phishing queue, especially when CA trust advisories land.
- Join SEG click logs to SSO and MFA events on a fixed user key with a documented ±2 hour correlation window.
- Document contain actions that prefer session revoke and step-up auth over waiting for domain reputation alone.
Phishing URL detection earns its keep when a lookalike with a valid certificate still triggers friction before the password form submits. Reputation lists remain useful for bulk cleanup. Structural features, certificate novelty, and the mail-to-auth join are what stop credential theft while the padlock still looks fine.
