We Are Fighting Phishing at the Wrong Layer
CSO Online, Thursday, October 8th, 2026
Blocking cheap phishing domains is futile; defenders should hunt the attacker's costly, shared proxy servers instead.
The author timed an attacker standing up a live credential-harvesting domain in under 24 minutes, which makes domain blocking a weak metric.
Adversary-in-the-middle phishing kits relay victims to real Microsoft sign-in pages and steal session tokens, and putting them behind CDNs and hostname-gated servers hides the origin so well that scanning, passive DNS and email headers all came up empty in one investigation.
The breakthrough came from a cookie Microsoft set with the proxy's IP address, which the proxy relayed to the victim unmodified, showing that finding servers exposes the attacker's whole infrastructure.